This Privacy Policy applies to Personal Information processed by U K Insurance Limited, but you might know us better as:

U K Insurance Limited is a registered data controller (reference number Z6487866) and a company within the Direct Line group of companies, which is part of the Aviva group of companies. Go to https://u-k-insurance.co.uk/group-companies.html to view companies in the same group as U K Insurance Limited. For more information about other companies in the Aviva group, see Aviva company details.

This Privacy Policy explains how we use Personal Information which we collect about individuals in relation to our products and services, in particular, our home, motor, pet, rescue (Green Flag) and Direct Line For Business insurance policies. It explains your rights and how to contact us if you have any concerns about our management of your Personal Information.

We take the security of your Personal Information very seriously. We use a combination of technical, organisational and physical security measures to protect your Personal Information in line with our obligations under data protection law. Our employees receive training to help us comply with data protection law and safeguard your privacy.

We may share your Personal Information in accordance with this Privacy Policy with other companies in the Aviva group. Each Aviva group company that processes your Personal Information is responsible for looking after it in accordance with this Privacy Policy. When we mention “we”, “us” or “our”, what we mean is the relevant company in the Aviva group that processes your Personal Information.

We have separate privacy policies for our different types of products, so if you have other Aviva group products you may need to review more than one privacy policy. We may also supplement this Privacy Policy with additional privacy notices tailored to our specific relationships with you where this is useful to provide you with a full picture of how we collect and use your Personal Information. This Privacy Policy supplements – but doesn’t override – them.

Most of the Personal Information we collect relates to the individual who is taking out a policy (or other individuals where it’s taken out jointly or otherwise for the benefit of others). We may also ask for Personal Information about other individuals if we need it. For example, if you ask us to provide insurance for someone other than you, such as other household or family members.

This Privacy Policy also explains how we use Personal Information which we collect about individuals who are not customers or prospective customers but whose Personal Information we process in connection with those products and services, including third party claimants, witnesses to an incident, individuals who have caused a policyholder a loss and whom we have a right to pursue in order to recover those losses, legal representatives, general practitioners and other medical or similar professionals, expert witnesses or other expert service providers, legal advisers and claims handlers, appointed representatives and other business partners, contact persons at corporate clients, and participants in market research, promotions and prize draws.

If you provide us with Personal Information about someone else, we’ll assume that you have their permission, where required. We’ll process their Personal Information according to this Privacy Policy so please encourage them to read it if they want to find out more.

Upcoming changes

A transfer of business from U K Insurance Limited to Aviva Insurance Limited is proposed to take place in December 2026 (not including travel insurance). From 31st December 2026, the underwriter of your policy will change to Aviva Insurance Limited, which will be a data controller of your Personal Information.

If you have a travel insurance policy or have made a claim on a travel insurance policy, U K Insurance Limited will remain a data controller of your Personal Information.

1. Sources of Personal Information

   We obtain Personal Information directly from you, including, from applications and claims forms you complete, communications between us, your participation in promotions and market research, your use of our apps and websites, details from the devices you use to interact with our apps and websites, and information from your vehicle’s telematics technology or onboard CPU. Where you are a joint policyholder, named driver or otherwise a beneficiary under a policy, we will also obtain Personal Information from the policyholder.

   We may receive your information from our policyholders when:

   • you are witness to an incident;
   • you are claiming against one of our policyholders;
   • one of our policyholders is claiming against you;
   • you are providing your professional services to any of these parties, e.g. as a medical expert; or
   • you are a driver or passenger in a car which is monitored using a telematics device or app.

   We may also obtain Personal Information from third parties, including the following:

   • Our business partners, where you have purchased a product through one of these third parties;
   • Comparison websites and other similar companies where you have used these companies to obtain quotes for our products;
   • Third parties who provide you with services relating to your product or claim, e.g. roadside assistance providers and home emergency cover;
   • Third parties who provide us, or a third party insurer relevant to your product or claim, with services, e.g. loss adjusters, claims handlers, legal advisers, banks, assistance providers, experts (including medical experts) and in limited circumstances, private investigators;
   • Third parties involved in your product or claim, e.g. other insurers, advisers, claimants, defendants and witnesses to an incident;
   • Aviva group companies who may provide information in relation to other products you or people you live with hold, previous claims, policies or quotes;
   • Credit reference agencies;
   • Financial crime, fraud or uninsured detection agencies, databases and sanctions lists, including the Motor Insurers' Bureau (MIB) who are the data controller for the Motor Insurance Database (MID), National Sira (a syndicated fraud prevention database operated by Synectics Solutions Limited), the Claims and Underwriting Exchange (CUE), Motor Insurance Anti-Fraud Theft Register, No Claims Discount Database, MyLicence, Whiplash Reforms Programme, Employers' Liability Tracing Office (ELTO), Insurance Fraud Bureau (IFB) and Cifas;
   • Government agencies and regulatory bodies including the police, the courts, the Driver and Vehicle Licensing Agency (DVLA), Driver and Vehicle Agency Northern Ireland (DVA), Driver and Vehicle Standards Agency (DVSA), the Department for Work and Pensions (DWP), Companies House, and HM Revenue & Customs (HMRC);
   • Regulators who regulate how we operate including the Financial Conduct Authority (FCA), Prudential Regulation Authority (PRA), Information Commission (IC) and the Financial Ombudsman Service (FOS);
   • If you are a service provider, such as a medical expert or solicitor, regulators who regulate how you operate including the General Medical Council and the Solicitors Regulation Authority;
   • Industry bodies, including the Association of British Insurers and the MIB;
   • Debt advisors, including where breathing space is requested on outstanding debts;
   • Third parties who provide us with details of individuals who have expressed an interest in hearing about insurance products;
   • Third parties that provide services in relation to your policy or claim, including checking no claims discounts;
   • Third parties that help us maintain the accuracy of our data, e.g. by identifying individuals who are deceased, updating contact details for individuals who have moved and payment card providers who provide us with updated payment card details;
   • Other third party suppliers including actuaries, auditors, legal advisers and other professional service firms and sanctions checking service providers;
   • Data suppliers, e.g. Experian, LexisNexis, Rightmove and Barbour ABI;
   • Publicly available sources including HM Land Registry, the Office for National Statistics (e.g. census data) and other data made available under the Open Government Licence, internet searches, news articles, online marketplaces and social media sites, apps and networks (e.g. Twitter, Facebook and Instagram);
   • Providers of marketing and advertising services;
   • Third parties in connection with any acquisition of a business by us;
   • If you have a rescue policy or are involved in an accident with a rescue policyholder, we may collect footage of individuals via externally mounted cameras on Green Flag vans; and
   • If you are a beneficiary of the Motability Scheme, Motability Operations Limited may provide information about you to help us manage and underwrite the Motability Contract Hire Scheme and the Family Fund Mobility Support Scheme.
2. Types of Personal Information collected

   The Personal Information we hold and process will depend on our relationship with you and the product or service we provide. For example, if you are a policyholder or a claimant claiming against one of our policyholders, we may collect detailed information about you and your claim. However, if you are an individual at a company who is providing services to us, e.g. a medical expert, the Personal Information we hold about you will be a lot more limited. We have set out some examples of the Personal Information we may hold, depending on our relationship with you below.

   Information provided by you or third parties, including:

   • General data - includes your name, gender, date of birth, age, marital status, country of residence/citizenship and your relationships to other people, e.g. family members on a joint insurance policy;
   • Contact data – includes your address, telephone number and e-mail address;
   • Identification data – includes government issued identification numbers, e.g. your driving licence number (in relation to motor insurance) and other identifiers, e.g. usernames and social media identifiers;
   • Appearance and behavioural data – includes your images, demographic data and behavioural data, e.g. how you interact with or use our products and services and your purchase history;
   • Product data – includes information about quotes, policies, schemes, relationships you have with intermediaries and claims, and any other information relevant to your product, including renewal dates, policy and claim histories and, in relation to home insurance, planning applications, property valuations, surveys and the value of your home contents;
   • Occupiers (in relation to home insurance) – data regarding other occupiers of your property, e.g. family members or lodgers;
   • Claims data – if a claim is made under an insurance policy, this includes information about the claim collected from you and relevant third parties, e.g. witnesses;
   • Communications data – information contained in the letters, emails, texts or web chats you have with us;
   • Fraud and sanctions related data – includes information obtained as a result of our investigations, e.g. carrying out checks of publicly available sources such as newspapers and social media sites and information obtained from checks of fraud databases and sanctions lists such as relationships/close associations with politically exposed persons;
   • Education and employment-related data – includes your education, vocational and professional qualifications, employment status, job title, salary and employment and educational history;
   • Vehicle and driving-related data (in relation to motor insurance) - includes driving licence entitlement and restrictions or endorsements, driving convictions, vehicle details including registration number, MOT details and carbon emissions, vehicle ID number, digital location ID and dash cam footage;
   • Financial data – includes credit and payment card numbers (including updated card information provided by card issuers when changes are made), bank account details, payment information, whether you provide a continuous payment authority, tax information, details of income and assets and, in relation to home insurance, mortgages;
   • Credit assessment data – includes information received from credit agencies, e.g. credit rating and details of bankruptcy orders, voluntary arrangements and county court judgments, including those associated with previous addresses. This helps us assess risk, verify your identity and prevent fraud. For further information see Credit Reference Agencies;
   • Vulnerability data – information about health, life events, resilience and capability that helps us identify if you might have additional support requirements in order that that we can better meet your needs;
   • Authentication data – includes account log-in information, passwords and memorable data for accessing your accounts;
   • Telephone recordings and online chat transcripts – information obtained during recordings of telephone calls or online chats with our representatives and call centres;
   • Marketing and communication preferences, promotion entries and customer feedback – includes marketing and communication preferences, information relating to promotions and prize draws, responses to surveys, complaints and details of your customer experience.

   Information provided by third parties, including:

   • Data about your vehicle, e.g. details about your MOT and your vehicle's mileage and information about the features of your vehicle, e.g. engine capacity (in relation to motor insurance);
   • Data about your property, e.g. whether it has a flat roof, whether it is listed, energy performance information and information about planning applications (in relation to home insurance);
   • Insights about you based on your relationship with a third party, e.g., if you apply for an insurance policy through one of our business partners such as your bank, our business partner may provide us with information about you;
   • Accurate contact data, e.g. where you have moved address, changed your telephone number or started using a new email address and not yet advised us. This data may be used to ensure that we have a complete understanding of your product holding and to provide you with communications about your products. It will not be used for direct marketing purposes unless it was collected by the third party expressly for that purpose and always in accordance with data protection law;
   • Information about quote requests to identify certain potentially unexpected, unusual or inconsistent connections and declarations, either between quotes or between individuals named on quotes in order to separate normal shopping behaviour from potentially fraudulent or higher risk behaviour;
   • Data about the area you live in, e.g.:
     • crime-related data;
     • census data;
     • government statistics on road traffic accidents in your local area;
     • house prices;
     • your council tax band;
     • subsidence data;
     • average garden size;
     • geographical area information and distance to various features such as the coast;
     • road and vehicle types;
     • modelled data which predicts characteristics about people in your area such as socio-economic groups as well as likely habits; and
     • flooding and weather-related data.

   If you are a witness, third party claimant, claiming against our policyholder, or have otherwise caused the policyholder a loss, we may also collect:

   • Detailed information about your claim from you, the policyholder, any witnesses, experts and third party service providers; and
   • Vehicle and driving-related data - includes driving licence entitlement and restrictions or endorsements, driving convictions, vehicle details including registration number and MOT details, vehicle ID number, digital location ID and dash cam footage if relevant to your claim.

   Information collected from your devices, including:

   • Mobile device number, device type, operating system, browser, IMEI or serial number, MAC address, IP address and account activity obtained through our use of cookies. You can find more about our use of cookies in our Cookies Notice.

   If you have a telematics device or app, information from your vehicle's telematics technology or onboard CPU, including:

   • Location, direction, speed, duration of journey, braking and cornering, impact or engine failures following an incident.

   CCTV and footage

   • Facial images maybe collected by CCTV.
   • Footage of individuals collected via externally or internally mounted cameras on Green Flag vans. This information might include footage around the operational vehicles to monitor a breakdown scene or if you are a passenger in one of our patrol vans. The vehicles equipped with these cameras will have visible notices, i.e. stickers, informing you of the presence of the cameras.

   Information already held by companies in the Aviva group, including:

   • Data relating to other Aviva policies or previous Aviva interactions– e.g. quote, policy and claim histories relating to other existing Aviva policies or products or those you may have applied for or held in the past, and contact details where you may have advised Aviva about a change on one product, but not another;
   • Modelled data that has been developed by Aviva using data that it already holds. For example:
     • we or Aviva may use data collected in relation to sums insured to develop a sum insured calculator to predict your likely required sum insured;
     • we or Aviva may use claims data to identify customers who are likely to claim more than others.

   Information inferred from your Personal Information, including:

   • Appearance and behavioural data – includes your general interests, descriptive data and behavioural data, e.g.to allow us to make certain predictions and assumptions about your interests, which allows us to personalise your experience with us;
   • Vulnerability data – information about health, life events, resilience and capability that helps us identify if you might have additional support requirements in order that we can better meet your needs;
   • Fraud and sanctions-related data – includes information obtained as a result of our investigations, e.g. carrying out checks of publicly available sources, e.g. newspapers and social media sites and checks of fraud databases and sanctions lists.

   Children’s data:

   • We collect data about children in some circumstances, for e.g. in relation to motor insurance, where a child is insured on an adult’s policy, where a child takes out a policy with us (e.g. car insurance for under 18s) or where a child is a claimant, and in relation to home insurance, where there are children living in the property.

   Sensitive Personal Information

   Sometimes we will request or receive Personal Information that is sensitive and we call this “Sensitive Personal Information”. This is information relating to your health, genetic or biometric data, sex life, sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs and trade union membership. It also covers criminal offence data, including information about criminal activity, allegations (including those unproven), investigations, proceedings and penalties. For example:

   • to investigate a bodily injury claim, we’ll need to ask you to provide details of the injury (in relation to motor insurance); or
   • we may hold information about any health condition or disability that has required an adaptation to your home (in relation to home insurance).

   We know how sensitive this data is, so protecting it is a top priority. The types of Sensitive Personal Information we hold and process where relevant include:

   • Health data – includes details of existing and previous physical or mental health conditions, health status, test results, medical diagnoses and treatment, e.g. personal injuries sustained as a result of a motor accident or public liability claim under home insurance;
   • Criminal data – includes driving licence endorsements, fixed penalties or pending prosecutions for any motoring offences for any of the persons insured, or to be covered under motor insurance, in relation to detecting and preventing fraud and for Automated Decision Making purposes;
   • Other sensitive data - in limited circumstances we may process other Sensitive Personal Information, e.g. information relating to your religious beliefs where relevant to your preferences regarding medical treatment.
3. Uses of Personal Information

   The main purposes for which we use Personal Information are to:

   • Communicate with you and other individuals;
   • Make assessments and take decisions, including whether to pay your claim or pursue any losses against you or a third party, provide you with our products and services, on what terms and whether you are eligible for a payment plan and to assess your driving score. For further information, see Automated Decision Making;
   • Process payments when you purchase a product or service, any refunds and payment or settlement of claims;
   • Provide our products and services, including insurance administration, taking payment, making changes where requested or necessary, managing renewal, claims assessment, settlement and dispute resolution and the provision of our apps and other technologies, e.g. My Account;
   • Determine eligibility to be covered by the Motability Scheme, and any special terms that may apply to you or permitted drivers.
   • Manage relationships with third parties, e.g. service providers;
   • Prevent, detect and investigate fraud and other crime, including by carrying out fraud, sanctions and anti-money laundering checks. For further information see Fraud and Other Financial Crime;
   • Improve our products and services, provide staff training and maintain information security, including by recording and monitoring telephone and online calls and screen sharing sessions;
   • Provide marketing information and run promotions in accordance with preferences you have expressed. For further information see the section on Marketing;
   • Conduct customer analysis, market research and focus groups, including customer segmentation, campaign planning, creating promotional materials, gathering customer feedback and customer satisfaction surveys;
   • Record and analyse data about the driving behaviour of you and anyone who drives your car if you have a telematics device or app as part of your policy;
   • Help us better understand our customers and improve our customer engagement, including noting your interest in our website, understanding your customer journey, and use of profiled data (which is not actual information about you but predictions about you, e.g. assumptions about your interests based on the preferred leisure pursuits of households your area). This allows us to make correlations about our customers to improve and promote our products and to suggest other products, services and information which may be relevant or of interest to customers;
   • Carry out data analysis, including to ensure data accuracy and quality and for insurance risk modelling and product and pricing refinement. For further information see Profiling, Data Analysis and Artificial Intelligence;
   • Manage complaints, including to allow us to respond to any current complaints, or challenges you or others might raise later, for internal training and monitoring purposes and to help us to improve our complaints handling processes. We may be obliged to forward details about your complaints, including your Personal Information, to the appropriate authorities, e.g. the relevant ombudsman;
   • Manage feedback and queries and handle requests to exercise data subject rights. For further information see Data Rights;
   • Manage our business operations, including by carrying out internal audits, quality assurance and training, financial analysis and accounting, producing management information and performing administrative activities in connection with the services we provide;
   • Manage commercial risk, including by taking out and maintaining appropriate insurance and reinsurance;
   • Comply with applicable legal, regulatory and professional obligations, including cooperating with regulatory bodies (e.g. the IC, FCA and PRA), MIB and government authorities, to comply with law enforcement and to manage legal claims;
   • Identify and support individuals requiring additional support, to help us better meet your needs and to comply with regulatory guidance about how we meet your needs. Sometimes you or a third party may tell us that you have additional support requirements, and in other cases we may infer this from your Personal Information and our interactions with you;
   • Establish, enforce and defend our legal rights or those of third parties, including enforcing our terms and conditions, pursuing available remedies and limiting our damages;
   • Carry out activities that are in the public interest, e.g. we may need to use Personal Information to carry out anti-money laundering checks;
   • Buy, sell, transfer or dispose of any part of our business;
   • Archiving, scientific or historical research or statistical purposes.
4. Lawful Bases for uses of Personal Information

   We are committed to collecting and using Personal Information in accordance with applicable data protection laws. By law, we must have a legal justification, known as a lawful basis, in order to use your Personal Information for the purposes described in this Privacy Policy. Depending upon the purpose, our lawful basis will be one of the following:

   • Performance of a contract - to arrange, underwrite or manage our products, or handle claims in accordance with their terms;
   • Compliance with a legal obligation - to meet responsibilities we have to our regulators, tax officials, law enforcement, or other legal responsibilities;
   • Legitimate interests - to operate and improve our products and services and keep people informed about our products and services or for any other purposes we identify as appropriate to our business needs, or those business needs of a third party;
   • Recognised legitimate interests – for specified purposes for handling Personal Information in the public interest, including protecting the physical, mental or emotional well-being of individuals, preventing, detecting or investigating crimes, responding to emergency situations, national security and public task disclosures;
   • Consent - where we have obtained appropriate consents to collect or use your Personal Information for a particular purpose.

   Where we rely on legitimate interests as our lawful basis, we are required to carry out a balancing test to ensure that our interests, or those of a third party, do not override the rights and freedoms that you have as an individual. The outcome of this balancing test will determine whether we can use your Personal Information for the purposes described in this Privacy Policy. Where we rely on the lawful basis of legitimate interests, the interests being relied upon will usually be:

   • To further our business and commercial activities and objectives, or those of a third party, e.g. to provide our products and services and produce management information on our performance and the performance of third parties;
   • To help us better understand our customers and improve our customer engagement and marketing campaigns including by carrying out analysis, marketing analytics and profiling, e.g. by making certain predictions and assumptions about your interests;
   • To send you marketing information in accordance with your preferences, e.g. about other products and services we offer, and to administer promotions that you enter;
   • To provide you with helpful information relating to your products and about useful tools for managing and engaging with your products. These are not marketing communications;
   • To comply with our legal and regulatory obligations, guidelines, standards and codes of conduct, e.g. background checks or the prevention, detection and investigation of financial crime or fraud;
   • To improve and develop our business, products and services, or those of a third party, e.g. to ensure the accuracy of customer data and to develop our pricing and risk methods and models;
   • To retain your policy record for a period of time in order to ensure we have appropriate records in place in respect of any future claims that may be insured by us;
   • To safeguard our business, shareholders, employees and customers, or a third party, e.g. maintaining the security of our IT network and information, enforcing claims, including debt collection;
   • To facilitate the purchase, sale, transfer or disposal of any part of our business; and
   • To analyse and assess competition in the market for our products and services, e.g. by carrying out market research.

Our lawful bases for the use of Personal Information:

Purpose	Lawful Basis for Personal Information Processing
Communicating with you and others including complaints handling	Performance of a contract Compliance with a legal obligation Legitimate interests
Identifying individuals requiring additional support	Compliance with a legal obligation Legitimate interests Recognised legitimate interests Consent
Evaluating your application or renewal, to provide a quote, or to determine eligibility to be covered by the Motability Scheme	Performance of a contract Legitimate interests
Provision of our products and services and administration of a policy including taking payment	Performance of a contract Compliance with a legal obligation Legitimate interests
Managing third party relationships	Performance of a contract Legitimate interests
Claims assessment and management of claims	Performance of a contract Compliance with a legal obligation Legitimate interests
Financial or other crime, fraud and credit checks	Performance of a contract Compliance with a legal obligation Legitimate interests Recognised legitimate interests
Compliance with legal or regulatory obligations	Compliance with a legal obligation
Establish, enforce or defend legal rights	Compliance with a legal obligation Legitimate interests
Record and analyse data about driving behaviour	Performance of a contract Legitimate interests
Improving quality, training and security	Legitimate interests
Managing our business operations e.g. accounts, financial analysis, internal audit	Compliance with a legal obligation Legitimate interests
Profiling and data analysis (including modelling)	Legitimate interests
Applying for or claiming on our insurance	Legitimate interests
Marketing and customer insight analysis, campaign planning etc.	Legitimate interests Consent
Marketing in accordance with your preferences	Legitimate interests Consent
Buy, sell, transfer or dispose of our business	Compliance with a legal obligation Legitimate interests
Archiving, research or statistical purposes	Legitimate interests

We can only collect and use Sensitive Personal Information where we have an additional, specific lawful basis to process such information. We usually rely upon one of the following lawful bases where we process Sensitive Personal Information:

• Reasons of substantial public interest:
  • insurance purposes – including advising on, arranging, underwriting and administering contracts of insurance, administering claims under a contract of insurance and exercising rights, or complying with obligations that arise in connection with contracts of insurance;
  • complying, or helping someone else comply with, a regulatory requirement relating to unlawful acts and dishonesty - including regulatory requirements to carry out money laundering checks;
  • preventing or detecting unlawful acts – including disclosures to competent authorities;
  • preventing fraud – including investigating alleged fraud;
  • safeguarding the economic well-being of certain individuals – including where we identify additional support required by our customers;
  • equality of opportunity or treatment – including where we need to keep under review the equality of treatment of customers with additional support needs.
• Necessary to establish, exercise or defend a legal claim – including where we are faced with legal proceedings, we bring legal proceedings ourselves or where we are investigating legal proceedings that a third party has brought against you;
• Necessary to protect your vital interests or those of another individual;
• Information has been clearly or obviously made public by you.

Our lawful bases for the use of Sensitive Personal Information:

Purpose	Lawful Basis for Sensitive Personal Information Processing
Communicating with you and others including complaints handling	Necessary for insurance purposes Legal claims Necessary for safeguarding economic well-being of certain individuals
Identifying individuals requiring additional support	Necessary for safeguarding economic well-being of certain individuals Necessary for the equality of opportunity or treatment Explicit consent
Evaluating your application or renewal or to provide a quote	Necessary for insurance purposes
Providing and administrating a policy, including taking payment	Necessary for insurance purposes
Managing third party relationships	Necessary for insurance purposes
Claims assessment and management of claims	Necessary for insurance purposes Legal claims Vital interests
Identifying or investigating financial or other crime and fraud	Necessary for insurance purposes Legal claims Regulatory requirement relating to unlawful acts or dishonesty Clearly or obviously made public by you Prevent or detect crime Prevent fraud Necessary for safeguarding economic well-being of certain individuals
Compliance with legal or regulatory obligations	Necessary for insurance purposes Legal claims Regulatory requirement relating to unlawful acts or dishonesty
Establishing, enforcing or defending legal rights	Legal claims
Improving quality, training and security	Legal claims Explicit consent
Managing our business operations, e.g. accounts, financial analysis, internal audit	Legal claims Explicit consent
Profiling and data analysis (including modelling)	Necessary for insurance purposes
Applying for or claiming on our insurance	Necessary for insurance purposes Legal claims
Buying, selling, transferring or disposing of our business	Necessary for insurance purposes Legal claims Explicit consent
Archiving, research or statistical analysis	Necessary for archiving, research or statistical analysis

Where we cannot rely on one of the above lawful bases to process your Sensitive Personal Information for a particular purpose, we will seek your explicit consent.

If you would like to know more about the lawful bases we rely upon, or how the lawful basis of legitimate interests applies to a particular purpose, you can contact us.

In connection with the purposes set out above, we will sometimes share Personal Information with Aviva group companies and third parties, including:

• Business partners who help us arrange, manage and underwrite our products and who provide insurance services;
• The relevant third party if they are making a claim against you;
• The relevant policyholder if you are making a claim against that policyholder or have otherwise caused that policyholder a loss;
• Comparison websites and other similar companies that offer ways to research and apply for financial services products;
• Other insurers (either directly or via those acting for the insurer);
• Our insurers or reinsurers (either directly or through insurance brokers), who provide reinsurance services to us and each other in respect of risks underwritten by us, or insurers who cover us under our group insurance policies. We can supply on request further details of the insurers and reinsurers we provide your Personal Information to and how this may be used. If you require further details contact us;
• Joint account holders where products are affiliated to a joint account, or where you use a shared email address to manage your online account or claim, some information will be visible to the other account holder or individual using the shared email address. You can change the email address associated with your online account at any time;
• Representatives and nominees in some circumstances, e.g. your spouse/partner or another person where they are named on the agreement or you have provided permission for us to speak with them;
• Third parties who provide you with services relating to your product, e.g. roadside assistance providers in relation to motor insurance, home emergency cover in relation to home insurance and other assistance providers;
• Third parties who provide us, or a third party insurer relevant to your product or claim, with services, e.g. funding partners, loss adjusters, claims handlers, assistance providers, third-party case managers handling your care or treatment pathway, experts and, in limited circumstances, private investigators;
• Legal advisers, accountants, financial institutions, auditors and professional service firms who act on our or your behalf, or who represent a third-party claimant;
• Data analysts and providers of data services who support us with developing our products and prices and measuring the effectiveness of marketing;
• Third parties that help us maintain the accuracy of our data, e.g. by identifying individuals who are deceased, updating contact details for individuals who have moved and payment card providers who provide us with updated payment card details;
• Companies who help us to check your identity and evaluate your insurance risk by collecting data about you from public sources (such as the electoral register and insolvency service) and private databases (such those contributed to by other insurers), including LexisNexis;
• Financial crime detection agencies, financial services organisations, sanctions checking providers and third parties who maintain fraud detection databases or provide assistance with investigation in cases of suspected fraud;
• Regulators who regulate how we operate, including the FCA, PRA, FOS, HMRC, IC and the Advertising Standards Authority;
• Regulators who regulate how you operate, including the General Medical Council and the Solicitors Regulation Authority;
• Government agencies and regulatory bodies including the police, courts, DVLA, DVA, DVSA and the DWP;
• Debt advisors, including where breathing space is requested on outstanding debts and insolvency practitioners in the event of insolvency;
• Insurance industry bodies, including the Association of British Insurers and the MIB;
• Credit reference agencies;
• Data analysts and service providers, including those who help organise travel arrangements, operate our IT and back office systems, underwriting and claims processes and our information security controls;
• Third party payment service providers who process card and other payments for us;
• Medical professionals, if we need to access health records or assessments for the purposes of arranging and underwriting certain products or facilitating and handling claims;
• Flood Re scheme to assist you with getting insurance in flood risk areas;
• Motability Operations Limited and their third party providers if you are a beneficiary of the Motability Scheme. For further details, please see their privacy notice at motability.co.uk;
• Research agencies and providers of market research services, including customer feedback surveys;
• Providers of marketing and advertising services, including delivering and administering marketing, ensuring you receive marketing content that’s relevant to you and in accordance with your preferences and analysing marketing campaigns. These may include media agencies, fulfilment partners, addressable TV providers, social media and other online platforms and advertising technology companies. You can find further information about this in the section on Marketing; and
• Third parties in connection with any sale, transfer or disposal of our business.

Some of the organisations we share information with may be located outside of the UK. For further information, please see the section on International Data Transfers.

We use your Personal Information to detect and prevent fraud and other financial crime, including to meet our statutory and regulatory responsibilities in relation to fraud and financial crime.

If you’re making an application or a claim, we may use profiling and other forms of automated processing to assess the probability that your application or claim may be fraudulent. This assessment may involve the use of Sensitive Personal Information or criminal data. For example, we may use your past motoring convictions for motoring insurance or details of any convictions relating to fraud or dishonesty. See Automated Decision Making for further details.

We may also use your Personal Information including details of our interactions with you to help us detect fraud committed by brokers or financial advisers or to identify where you or a third party may be at risk of fraud or other financial crime.

To prevent, detect and investigate fraud and other financial crime, we:

• check public registers (e.g. the electoral roll or registers of county court judgments, bankruptcy orders or repossessions);
• conduct online searches from websites, social media and other information-sharing platforms;
• use software provided by Transunion, whose privacy policy can be viewed here to collect certain device-identifying technical data to identify suspicious and/or high risk devices used to access our websites and mobile applications;
• use databases managed by credit reference agencies, insurance industry bodies, fraud detection agencies and other reputable organisations. This includes National Sira administered by Synectics Solutions Limited (as joint data controller together with contributing companies, including other Aviva group companies), Experian whose Privacy Policy can be viewed here and the Insurance Fraud Bureau whose Privacy Policy can be viewed here and Cifas; and
• share Personal Information and undertake searches with other third parties, including other insurers, fraud prevention agencies, law enforcement agencies, public bodies and our regulators (which include the FCA, PRA, ELTO, MIB and IC).

This will help us verify your identity, make decisions about providing you with our products and related services, e.g. paying claims and trace debtors or beneficiaries.

If you give us false or inaccurate information and we suspect fraud, we’ll record this to prevent further fraud and money laundering. This may be shared between insurers and with fraud prevention agencies and databases.

We can supply on request further details of the agencies and databases we access or contribute to and how this information may be used. If you require further details, please contact us.

For details relating to information held about you by the DVLA please visit http://dvla.gov.uk/

How your Personal Information is used and shared by insurers and databases in relation to motor and home insurance

The Personal Information you provide will be used by us and shared with other insurers as well as certain statutory and other authorised bodies for:

• Insurance underwriting purposes, i.e. to examine the potential risk in relation to your (and/or a third party’s) prospective policy so that we can:
  • consider whether to accept the relevant risk;
  • make decisions about the provision and administration of insurance and related services for you and members of your household;
  • validate your (or any person or property likely to be involved in the policy or claim) claims history (at any time including upon application for insurance, in the event of an accident, incident or a claim, or a mid-term adjustment, or at a time of renewal).
• Management information purposes, i.e. to analyse insurance and other markets for the purposes of:
  • portfolio assessment;
  • risk assessment;
  • performance reporting;
  • management reporting.
• Anti-fraud purposes, i.e. to detect and prevent fraudulent claims and/or activities by:
  • sharing information about you with other organisations and public bodies including the police;
  • tracing debtors or beneficiaries, recovering debt, managing your accounts and/or insurance policies;
  • undertaking fraud searches. Insurers pass information to fraud prevention agencies and databases including National Sira, the CUE Register and where appropriate the Motor Insurance anti-Fraud and Theft Register by MIB. This helps insurers check information and prevent fraudulent claims. When we deal with your request for insurance we may search these registers. Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years.
• Compliance with legal obligations and responsibilities, including:
  • claims management – In the event of a claim we may need to disclose information with any other party involved in that claim, e.g. third parties involved in the incident, their insurer, solicitor or representative and medical teams, the police or other investigators. We also may have to investigate your claims and conviction history;
  • complaints management – If you make a complaint about the service we have provided, we may be obliged to forward details about your complaint, including your Personal Information, to the relevant ombudsman;
  • information about your insurance policy will be added to the MID managed by the MIB. MID and the data stored on it may be used by certain statutory and/or authorised bodies including the police, the DVLA, the DVA, the Insurance Fraud Bureau and other bodies permitted by law. This information may be used for purposes permitted by law, which include:
    • electronic Licensing;
    • continuous insurance enforcement;
    • law enforcement (prevention, detection, apprehension and/or prosecution of offenders);
    • the provision of government services and/or other services aimed at reducing the level and incidence of uninsured driving.

  If you are involved in a road traffic accident (either in the UK, the European Economic Area or certain other territories), insurers and/or the MIB may search the MID to obtain relevant information.

  Individuals who may be citizens of other countries or their appointed representatives making a claim in respect of a road traffic accident may also obtain relevant information which is held on the MID. It is vital that the MID holds your current registration number. If it is incorrectly shown on the MID you are at risk of having your vehicle seized by the police and/or a fixed penalty notice.

  You can check that your current registration number details are shown on the MID at www.askmid.com.

How your Personal Information will be processed

• Information which is supplied to fraud prevention agencies and databases, e.g. National Sira, MIB and MID can include details like your name, address and date of birth.
• Your data may be supplied to databases in order to facilitate automatic no claim discount validation checks.
• Your data may be transferred to any country, including countries outside of the UK and European Economic Area, for any of the purposes mentioned above.
• Under your policy you must tell us about any incident (e.g. an accident or theft) which may or may not give rise to a claim. When you tell us about an incident, we will pass information relating to it to the fraud prevention agencies and databases, e.g. MIB.

You can ask for more information about this. If you require such information, please contact us.

How we use your Driving Licence Number

Insurance underwriting purposes, i.e. to examine the potential risk in relation to your (and/or a third party’s) prospective policy so that we can:

• Provide your (or any person included on the proposal) Driving License Number (DLN) to the DVLA to confirm your (or the relevant person included on the proposal) licence status, entitlement and relevant restriction information and endorsement/conviction data. Searches may be carried out prior to the date of the insurance policy and at any point throughout the duration of your insurance policy including at the mid-term adjustment and renewal stage. A search of the DLN with the DVLA should not show a footprint against your (or another relevant person included on the proposal) driving licence;
• Searches may be carried out at point of quote and, if an insurance policy is incepted, if any changes are made mid-term, and at renewal stage.

Please note that if you give us false or inaccurate information it may invalidate your insurance policy/prospective insurance policy or it could affect the amount we pay to settle any claims you make under the policy.

When you purchase a motor or a home insurance policy, we will carry out assessments to determine whether we can offer you a credit payment facility and the below checks will be undertaken.

We or our agents may:

• undertake checks against publicly available information (e.g. electoral roll, county court judgments, bankruptcy orders or repossession(s)). Similar checks may be made when assessing claims; and
• carry out a quotation search from a credit reference agency. We do this so that we are able to offer monthly credit payment options.

We use data from a credit reference agency to verify your identity, prevent fraud and carry out risk profiling which allows us to calculate your premium and payment options. We may need to obtain information relating to you at quotation, renewal and in certain circumstances where policy amendments are requested.

You will be informed about these assessments before we do them. This leaves a "soft footprint" on your credit file which can only be seen by you and does not affect your credit score.

As part of our regulatory obligations, if you choose to pay your premium by instalments, we will carry out an affordability assessment. We do this using information from a credit reference agency including an over-indebtedness score and some of the underlying data used to calculate this score. The credit reference agency calculates your over-indebtedness score using information it holds about your existing credit commitments and modelled information relating to income and living expenses. We will use your over-indebtedness score to help assess whether additional credit could cause you financial harm. We will do this when you request a quote and at renewal so that we can decide whether to offer you a monthly credit payment option.

The quotation and affordability searches will appear on your credit report and will be visible to other credit providers. It will be clear it is part of a quote and not a credit application by you. Where you agree to pay monthly under a credit agreement, the status of your quote search will be updated to reflect your credit application and this will be visible to other credit providers.

In order to carry out these searches we will supply your Personal Information to credit reference agencies and they will give us information about you, such as about your financial history. We do this to assess creditworthiness (including affordability) and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity. We will also continue to exchange information about you with credit reference agencies on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. Credit reference agencies will share your information with other organisations. Your Personal Information will also be linked to the data of your spouse, any joint applicants or other financial associates.

If you do not make payments that you owe us, we will trace your whereabouts and recover debts. Failure by you or anyone who pays for your policy to keep up the monthly payments due under your credit agreement will be reflected in your credit score, not theirs. These records remain on file for six years after they are closed, whether settled by you or defaulted.

Where you are a named driver on a car insurance policy, in order to ensure we have the necessary facts to assess your insurance risk, verify your identity, help prevent fraud and provide our best premium and payment options, we may need to obtain information relating to you at quotation, renewal and in certain circumstances where policy amendments are requested. We or our agents may undertake checks against publicly available information (e.g. electoral roll, county court judgments, bankruptcy orders or repossession(s)).

CRAs will share personal information with other organisations. The identities of the CRAs and the ways in which they use and share personal information are explained in more detail at www.experian.co.uk/crain, www.transunion.co.uk/crain and www.equifax.co.uk/crain.

We may use automated processes to make decisions. These automated processes use data provided by you, other records we hold about you in our systems and data sourced from third parties to make predictions, which may include the likelihood that a claim will be made and its value, the likelihood a product will be purchased and the likelihood that a claim might be fraudulent. This helps us to determine eligibility for a policy, the terms of the policy, the price, and whether we can provide you with a monthly credit payment option.

For example, in order to provide you with a price for your insurance policy, the following steps are taken:

• You provide us with data: The first step is that you tell us who you are and what you are looking to have insured, e.g. the vehicle you drive, details about your property or details about your pet.
• We enrich the data you have provided: Once you have provided us with data, we carry out checks to validate this data (e.g. confirming your identity) and enrich it with data from third party sources. Information on the third party data sources we use is set out above in Types of Personal Information collected. For example, for motor insurance we use the vehicle registration number you provided to source additional information on the car you drive from the DVLA. For home insurance, we use your address to source additional information on the area you live in.
• We calculate your insurance risk: We use statistical modelling techniques to assess the data in order to predict the likelihood that a claim will be made and the likely severity of a claim. This assessment is based on various factors including information about the area you live in such as the likelihood of crime. For example, if you live in an area with high crime this may lead to a higher premium. All insurers will use different weightings to price insurance and this is confidential to each insurer.
• Provision of the final price: Once we have a view of your insurance risk we can provide you with a final price, which will include any commission payments and insurance premium tax.

Your personalised price may be presented to you in suitable marketing communications, including those sent from price comparison websites or third party partners with whom you have a relationship.

We also make automated decisions throughout the life of your policy, e.g. before offering you a renewal or when dealing with a claim.

Where we make an automated decision using Personal Information which has a legal or substantially similar effect, you have certain rights in relation to that decision. In particular, you have the right to receive meaningful information about the logic involved in relation to the decision, the right to information about the decision, the right to request human intervention, and the right to express your view and challenge the decision. For more information about this right and how to exercise it please see Data Rights.

We process Personal Information to perform profiling and data analysis to build, train and audit insurance and third party models and algorithms (including those used in our Automated Decision Making).

We also use artificial intelligence and machine learning technologies. Artificial intelligence is a machine’s ability to perform tasks we associate with humans. For example, problem solving, learning and decision making. Machine learning is a type of artificial intelligence that teaches machines to learn and interpret from information and then provide a response. One type of artificial intelligence that we use is natural language processing. Natural language processing involves reading, understanding and analysing speech and text (including the sentiment expressed). We may use this to help us with the purposes listed below.

The models, algorithms, and tools we use do a number of things including:

• understanding our customers and potential customers better, e.g., how they feel about us, what kind of content or products would be of most use and interest to them (for further information please see Marketing), whether they might be displaying characteristics meaning that they may require additional support from us;
• managing underwriting and claims e.g. assisting handlers to locate information, triaging and routing queries to the right teams, underwriting assessments, determining liability, valuing claims;
• interacting with you in conversation to help you with your query;
• identity verification and fraud detection;
• monitoring and improving our processes and services e.g. by generating summaries of claims notes, looking how to identify and prevent complaints;
• predicting the likelihood of events arising to assess insurance risk, the likelihood a product will be purchased or to predict if a claim might be fraudulent; and
• ensuring data quality and accuracy e.g. checking the way our models, algorithms and machine learning tools work.

To carry out these purposes we may combine your Personal Information with information relating to other customers, potential customers and/or data provided by third parties. We may also use the Personal Information you submitted to obtain a quote from us for this analysis whether or not you decided to purchase the product.

We use a number of data items as described in this Privacy Policy for these purposes. Before we use any such data, we carry out a number of checks including ensuring there are no legal restrictions on using the data under data protection laws, the Equality Act 2010 or under FCA rules and we consider whether use of the data might cause outcomes that are unfairly or unlawfully biased. We then use statistical modelling techniques to assess the data to ensure that the data tells us something meaningful. From time to time, we may share your Personal Information with third parties who provide us with new data which we will test to understand if such new data provides additional understanding.

Where possible, we pseudonymise the Personal Information to perform this analysis. This means that we remove information from which you can be directly identified, e.g. your name and replace it with a pseudonym or unique identifier. We do this to maximise the security of your information.

We keep Personal Information for as long as is reasonably required for the purposes explained in this Privacy Policy. We also keep records - which may include Personal Information - to meet legal, regulatory, tax or accounting needs. For example, we are required to retain an accurate record of your dealings with us, so we can respond to any complaints or challenges you or others might raise later. We’ll also retain files if we reasonably believe there is a prospect of litigation. The specific retention period for your Personal Information will depend on your relationship with us and the reasons we hold your Personal Information.

To support us in managing how long we hold your data and our record management, we maintain a data retention policy which includes clear guidelines on data retention and deletion.

If you would like more information about our data retention policy, please contact us.

Sometimes we, or third parties acting on our behalf, may need to transfer Personal Information outside of the UK. We’ll always take steps to ensure that any transfer of Personal Information outside the UK is carefully managed to protect your privacy rights and ensure that adequate safeguards are in place. This might include transfers to countries that the UK considers will provide adequate levels of data protection for your Personal Information (such as countries in the European Economic Area) or putting contractual obligations in place with the party we are sending information to. Transfers within the Aviva group will be covered by an agreement entered into by members of the Aviva group (an intra-group agreement) which contractually obliges each group company to ensure that your Personal Information receives an adequate and consistent level of protection wherever it is transferred within the group.

For more information about data transfers and the safeguards we have put in place, please contact us.

We may use Personal Information to send you direct marketing communications about our products and services that we feel you’ll be interested in. This may include marketing relating to products offered by other brands or companies within the Direct Line group and the Aviva group, as well as communications about promotions and prize draws. Go here to view the Direct Line group of companies. For more information about other companies in the Aviva group, see here.

Marketing communications may be sent by email, post, SMS, telephone and push notification. You may also see display advertising on websites, mobile applications, social media, television or in online search results.

These communications will be sent and displayed to you based on your preferences:

• With your consent we will send you direct marketing via email and SMS.
• We will contact you by phone or post or display marketing to you in your social media channels or web browser unless you've told us you'd prefer we didn't contact you in this way.
• If you are a business customer then we will contact you by email but you can let us know at anytime if you want to stop receiving these communications.

You can let us know at any time if you no longer wish to receive marketing messages. The simplest way to do this is to click on the unsubscribe link on emails or respond using the return address on the envelope. You can also contact our Data Rights Team, please see 'Contacting us' for more information.

Please note that opting out of one type of marketing, e.g. by email, doesn’t mean you will be opted out of all marketing. Bear this in mind when you manage your preferences. You can always contact us directly if you would like us to stop all forms of direct marketing.

You will continue to receive marketing once your product has ended unless you choose to opt out. We try to limit marketing and only send you offers and promotions that you might be interested in, based on Personal Information we have about you and profiling that we have carried out (further details can be found under the sub-heading ‘Marketing profiles’ below). We may use information provided by third parties to send you direct marketing and we may use your Personal Information to send other people direct marketing, e.g. people you live with.

Please remember that if you opt out of receiving marketing, we will still send you communications relating to your products. If you choose to opt out of tailored offers and advertising, you may still see generic advertising displayed online and in My Account, it just might not be as relevant to you.

You will not receive marketing if you are a beneficiary of the Motability Scheme.

Cookies and similar technologies

We rely on third-party advertising technology (such as the deployment of cookies or small text files on our website or pixels within emails) to collect information about you. This technology is used to optimise what you may see on our websites and deliver content when you are browsing elsewhere. We may also collect information about your use of other websites. We do this to provide you with advertising that we believe may be relevant for you, as well as to improve our own products and services.

For further information about cookies and other technologies we use on our website and how to manage cookies, please see our Cookies Notice.

Social media and online platforms

We share Personal Information with media agencies and social media and other online platforms to help us target our online marketing. Social media and other online platforms may also use Personal Information they hold and combine it with Personal Information received from us to create target audiences. These are audiences that we think would be interested in our online advertising. This may involve social media and other online platforms building a ‘lookalike’ profile of the type of person we are trying to target and providing specific adverts to those people when they browse the internet or use social media.

We may use Meta Business Tools to target advertising and act as a joint controller with Meta when doing so. For further details about Meta’s processing of your Personal Information or to exercise your data subject rights against Meta, please see the Meta Privacy Policy.

If we use or share Personal Information with third parties to send you direct marketing, we will respect the marketing preferences you have set. We recommend you routinely review the privacy notices and preference settings that are available to you in My Account and any online platforms and smart devices you use as they will dictate how adverts and other messages are displayed and shared across those platforms.

Marketing profiles

We use automated processes to help us provide more personalised marketing of our products. To do this, our automated process creates a marketing profile for you using information such as:

• identification data;
• behavioural data (e.g. data relating to your use of our website);
• your gender and age;
• contact data;
• status data (e.g. number of children in household);
• product related data (e.g. policy identifiers, renewal date);
• details of our interactions with you;
• device and vehicle-related data.

Our process analyses this data to determine the most relevant products, services, offers or benefits to offer you and to decide the appropriate time and channel for offering them to you. We also use your Personal Information to provide tailored offers to you.

Information obtained in relation to one product may be used in relation to marketing other products from the Direct Line group or the Aviva group.

We may also create profiles using your Personal Information together with information relating to other individuals, we use these profiles to decide what marketing may be of interest to individuals with similar characteristics to you.

Promotions and prize draws

We occasionally run promotions and prize draws for our customers and third parties. Our communications to you about these promotions before you enter them are marketing. If you opt out of receiving direct marketing, you will not receive communications about promotions and prize draws.

We may use your Personal Information to select you as a winner, inform you of promotion outcomes and send prizes to your nominated address. We may use third party fulfilment partners to assist us in administering promotions, including contacting you on our behalf. In accordance with the rules of the Advertising Standards Authority, we may publish or make publicly available information that indicates that a valid award has taken place. If we do this, only your surname, country and, if applicable, your winning entry, will be published. You have the right to object to this use of your Personal Information.

You have legal rights under data protection laws in relation to your Personal Information. Read below to learn more about each right you may have.

We may ask you for proof of identity when you make a request to exercise any of these rights. We do this to ensure we only disclose information to the right individual.

We aim to respond to all valid requests within one month. It may take us longer if the request is particularly complicated or you have made several requests. We’ll always let you know if we think a response will take longer than one month. We may also ask you to provide more detail about what you want to receive or are concerned about.

We may not always be able to do what you have asked. This is because your rights will not always apply, e.g. if it would impact the duty of confidentiality we owe to others, or if the law allows us to deal with the request in a different way. We will always explain to you how we are dealing with your request. In some circumstances (such as the right to erasure or withdrawal of consent), exercising a right might mean that we can no longer provide our product to you.

For further information about or to exercise any of your rights, please contact us. If you wish to make a subject access request, please fill out this form.

Your rights are as follows:

Access to your Personal Information

You may ask us for a copy of your Personal Information together with specified details about how we use your information. This is commonly known as a ‘subject access request’.

If you wish to make a subject access request, please fill out this form or write to us using the details in the Contacting Us section.

If your request is made electronically, we will, where possible, respond to you electronically. Otherwise, we will normally respond in writing unless you request otherwise.

Rectification of your Personal Information

We do our best to ensure that your Personal Information is accurate and kept up to date. If you believe your information is inaccurate or incomplete, then please contact us to request that we amend or update it.

Erasing your Personal Information

You may ask us to erase your Personal Information, but this right only applies in certain circumstances, e.g. where:

• it is no longer necessary for us to use your Personal Information for the original purpose;
• our lawful basis for using your Personal Information is consent and you withdraw your consent; or
• our lawful basis is legitimate interests and there is no overriding legitimate interest to continue using your Personal Information if you object.

This isn’t an absolute right and we have to balance your request against other factors such as legal or regulatory requirements, which may mean we cannot erase your Personal Information.

Restricting processing of your Personal Information

You may ask us to stop using your Personal Information in certain circumstances such as:

• where you have contacted us about the accuracy of your Personal Information and we are checking the accuracy;
• if you have objected to your Personal Information being used based on legitimate interests.

This isn’t an absolute right and we may not be able to comply with your request.

Data portability

In some cases, you can ask us to transfer Personal Information that you have provided to us to another third party of your choice. This right only applies where:

• we have justified our use of your Personal Information based on your consent or the performance of a contract with you; and
• our use of your Personal Information is by electronic means.

Right to object

You can object if you no longer wish to receive direct marketing from us. Please see Marketing for further information.

You may also object where you have grounds relating to your particular situation and the lawful basis we rely on for using your Personal Information is our (or a third party's) legitimate interests or a recognised legitimate interest. However, we may continue to use your Personal Information where there are compelling legitimate grounds to do so.

Automated decision making and profiling

You have certain rights in relation to a decision made using your Personal Information which is based solely on automated processing (without meaningful human involvement) where that decision produces a legal effect or otherwise significantly affects you. In these circumstances you have a right to information about the decision, request human intervention, express your view and challenge the decision. Additionally, where the automated decision involves the use of Sensitive Personal Information, we may only do this where our lawful basis is that it is necessary for the purposes of a contract between us and you, authorised by law (e.g. to prevent fraud), or based on your explicit consent.

Withdrawing consent

In some circumstances we ask for your consent to use your Personal Information. You are free to withdraw your consent at any time.

If it is the case that we need your consent to provide you with a particular product and you wish to withdraw your consent, we may no longer be able to provide our product to you. Where that is the case, we will inform you before taking any action.

If you have any questions about this Policy, how we use your Personal Information generally or how to exercise your rights, then our Data Rights Team will be happy to help. They may be contacted in writing at: U K Insurance Limited, PO Box 882, Surrey Street, Norwich NR7 7EX by email at: Data.Rights.Requests@directlinegroup.co.uk or via this form https://www.u-k-insurance.co.uk/data-rights-request.html

If you’re not happy with the way we’re handling your Personal Information, you have a right to raise a concern with us about this. Please contact our Data Protection Officer via DataProtection@directlinegroup.co.uk or submit your complaint online here. To write to us please use the following address Data Protection Officer, U K Insurance Limited, PO Box 882, Surrey Street, Norwich NR7 7EX.

If you remain dissatisfied, you do also have the right to complain to the Information Commission (IC). We ask that you please attempt to resolve any issues with us before contacting the Information Commission.

The IC can be contacted at:

IC website: https://ico.org.uk/global/contact-us/

IC telephone: 0303 123 1113

IC textphone: 01625 545860

This Privacy Policy is updated from time to time to take account of changes in our business activities, legal requirements and to make sure it’s as transparent as possible, so please check back here for the current version. You can see when this Privacy Policy was last updated by checking at the bottom of this page.

Updated: 1 July 2026