YUTREE PRIVACY NOTICE
We are committed to protecting the confidentiality, integrity and availability of the personal data you provide to us. This Privacy Notice explains how we collect, use, share and protect personal data in connection with our insurance broking, claims handling and risk management services.
This notice applies to customers, prospective customers, policyholders, insured persons, beneficiaries, claimants, witnesses and other individuals whose personal data we process in connection with our services.
Information about other people
You may give us personal data about another person, for example, an employee, family member, director, driver or insured person. Where appropriate, you should make them aware that you are providing their personal data and direct them to this Privacy Notice. You must only provide their personal data where you are authorised or otherwise entitled to do so. We may also provide personal data to those persons where required to do so by law.
Who we are
Yutree Insurance Ltd (“Yutree”, “we”, “us” or “our”), trading as Yutree Media and Yutree Underwriting, is the data controller responsible for the processing of personal data as described in this Privacy Notice. We are registered with the Information Commissioner’s Office (ICO) under registration number Z3025297.
How to contact us:
For any questions or concerns relating to this Privacy Notice or our data protection practices, or to exercise your data protection rights, including making a complaint about how we handle your personal data, please contact us at:
Yutree Insurance Ltd
15 Kings Court
Willie Snaith Road
Newmarket
Suffolk
CB8 7SG
T: 01638 660651
Personal data we collect and our lawful bases for processing
The personal data we collect and process depends on the insurance product, the service you request and your relationship with us. In some cases, we may not need all of the types of data listed below.
The table explains the main categories of personal data we use, why we use it and the lawful basis we rely on under UK GDPR. In some circumstances, more than one lawful basis may apply, depending on the particular service we provide or the stage of our relationship with you.
| Personal Data We Use | Why We Use It | Lawful Basis |
|---|---|---|
Identity and contact information:
|
|
|
Information about the insurance risk:
|
|
|
Information relating to claims:
|
Claims administration, including:
|
|
Financial information, including:
|
|
Performance of a contract |
Information about other people, including:
|
|
|
Communication data, including:
|
|
|
Fraud prevention, financial crime and regulatory compliance information, including:
|
|
|
Technical information, including:
|
|
|
Marketing and preference information:
|
|
|
|
Business and corporate transaction information:
Where relevant |
To support:
|
Legitimate interest, subject to appropriate confidentiality and data protection safeguards |
Where we rely on legitimate interests, we will conduct a Legitimate Interest Assessment to ensure that we balance our interests against your rights and interests before relying on this basis.
If you do not provide information that we reasonably require, we may be unable to provide a quotation, arrange or administer insurance, deal with a claim, arrange credit or provide other requested services. We will tell you where providing information is a statutory or contractual requirement and the likely consequences of not providing it.
Special category data and criminal offence data
Depending on the insurance product or service you request, or the claim being handled, we may need to process special category data, particularly health information, and information about criminal convictions, offences, allegations or related security measures.
We only process this information where it is necessary for insurance purposes and where the UK GDPR and the Data Protection Act 2018 permit us to do so.
For special category data, we generally rely on Article 9(2)(g) of the UK GDPR (processing necessary for reasons of substantial public interest), together with the insurance condition in Schedule 1, Part 2, paragraph 20 of the Data Protection Act 2018.
Where we process information relating to criminal convictions and offences for insurance purposes, we do so in accordance with Article 10 UK GDPR and Schedule 1, Part 3, paragraph 37 of the Data Protection Act 2018, which applies the insurance condition in Schedule 1, Part 2, paragraph 20 to criminal offence data.
In some circumstances, we may instead rely on another condition permitted by data protection law, such as where processing is necessary for the establishment, exercise or defence of legal claims, to prevent or detect unlawful acts such as fraud, or where you have given your explicit consent.
Where we obtain personal data
We obtain personal data directly from you and from other sources, which may include:
- Policyholders, insured persons, beneficiaries, family members, employers, employees, directors, claimants, witnesses and representatives
- Insurers, underwriting agencies, insurance intermediaries, appointed representatives, claims handlers, loss adjusters, loss assessors, solicitors and other insurance market participants
- Credit reference agencies, fraud prevention agencies, sanctions and identity-verification providers
- Publicly available sources, including Companies House, the electoral register and other official registers
- Motor vehicle licensing authorities, the Motor Insurance Database and other insurance databases
- Professional advisers, regulators, law enforcement bodies and other third parties where permitted by law
Where we obtain personal data from another source, we will provide privacy information within the period required by law unless an exemption applies or you already have the relevant information.
Marketing
We may contact you about relevant products and services. We will use consent where required by the Privacy and Electronic Communications Regulations and may rely on legitimate interests where marketing is otherwise permitted by law.
You can opt out of marketing at any time by using the unsubscribe facility in the communication or contacting us using the details in the ‘How To Contact Us’ section above. Withdrawing consent or objecting to direct marketing will not affect our service or regulatory communications that we need to send to you.
We do not sell personal data. We will not disclose your personal data to an independent third party for that third party’s own marketing unless you have agreed to this or another lawful basis clearly applies.
Sharing information
We share personal data only where necessary, lawful and proportionate. Recipients may include:
- Insurers, reinsurers, underwriting agencies, coverholders, insurance intermediaries and product providers
- Claims handlers, loss adjusters, loss assessors, repairers, medical professionals, investigators, experts and other third parties involved in the claims process
- Premium finance providers, payment service providers, banks and credit reference agencies
- Fraud prevention agencies, insurance databases, including the Claims and Underwriting Exchange and Motor Insurance Database
- Identity, sanctions, anti-money laundering and financial crime screening providers
- Our appointed representatives, business partners, professional advisers, auditors, technology providers and other service providers
- The Financial Conduct Authority, Financial Ombudsman Service, Information Commissioner’s Office, courts, law enforcement bodies, tax authorities and other public authorities
- Prospective purchasers, investors, lenders or advisers in connection with a corporate transaction
For motor insurance, relevant policy information is supplied to the Motor Insurance Database. The database may be used by the police, the Driving and Vehicle Licensing Agency (DVLA), insurers and other authorised bodies to check insurance status, prevent or detect crime and handle accidents. Further information is available from the Motor Insurers’ Bureau at www.mib.org.uk.
Where a recipient processes personal data on our behalf, we require appropriate contractual, confidentiality and security obligations. Some recipients, such as insurers, finance providers, regulators and fraud prevention agencies, will process information as independent controllers under their own privacy notices.
International transfers
Some recipients or other service providers may process personal data outside of the UK and/or the EEA.
Where personal data is transferred to a country that is not covered by UK adequacy regulations, we use an appropriate safeguard where required, for example, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism. We will also carry out appropriate assessments where required to do so under UK law and adopt supplementary measures where appropriate. An exception may be used only where the legal requirements for that exception are met.
How long we keep information about you
We keep personal data only for as long as it is needed for the purpose for which it was collected, including to provide our services, comply with legal and regulatory requirements, resolve disputes and establish, exercise or defence of legal claims.
Our standard retention periods are:
| Type of Information | How Long We Keep It |
|---|---|
| Quotations where no policy is taken out | Up to six years from the date of the quotation. |
| Policy, renewal, claims and complaints records | Six years after the end of the policy, settlement of the claim or closure of the complaint, whichever is later. |
| Accounting, finance and business transaction records, including payment information | Six years from the end of the relevant financial year or business relationship, unless a longer period is required by law. |
| Marketing records and marketing preferences | Until you withdraw your consent or object to marketing, and for a limited period afterwards to maintain suppression records and demonstrate compliance with marketing laws. |
| Call recordings and routine correspondence | Normally up to six years where they relate to a policy, claim or complaint. Other business correspondence is retained in accordance with the relevant business record retention period. |
| Website and technical information | In accordance with our Cookie Notice and internal retention schedule, depending on the type of information collected. |
Automated decision-making and profiling
We, and third parties such as insurers, finance providers and fraud prevention agencies, may use automated processing or profiling to assess risk, calculate premiums, assess eligibility, detect fraud or determine whether a product or payment option can be offered.
Where a significant decision about you is based solely on automated processing, we will comply with the safeguards required by data protection law. These include providing you with information about the decision and giving you the opportunity to make representations, contest the decision and request human intervention.
Additional restrictions apply where a significant solely automated decision involves special category personal data. Where another organisation is responsible for the decision, you should refer to that organisation’s Privacy Notice for further information about its processing and how to exercise your rights.
Information from other sources
We may obtain personal data about you from publicly available sources and third parties, including the electoral register, credit reference agencies, fraud prevention agencies, insurers, other insurance intermediaries, motor vehicle licensing authorities and other insurance or industry databases. We may use this information for purposes such as verifying your identity, assessing risk or your credit history, preventing and detecting fraud, and providing or administering our products and services.
Where we receive personal data from a third party, that third party is responsible for its own collection and disclosure of your personal data. We are responsible for ensuring that our receipt and subsequent processing of your personal data complies with applicable data protection law and this Privacy Notice.
We and/or relevant third parties may also use personal data for statistical analysis, research and trend analysis, which may include profiling. Profiling may be used to help assess risk, understand or predict customer preferences, improve products and services, and assess which products or services may be suitable for you. Further information about automated decision-making and profiling is provided in the Automated decision-making and profiling section of this Privacy Notice.
Third parties that collect, use or share your personal data may act as independent data controllers and will have their own privacy notices explaining how they process your personal data, the purposes and lawful bases they rely on, and your rights in relation to their processing. If you would like further information about how a particular third party processes your personal data, you should review its privacy notice or contact that organisation directly.
Your data protection rights
Depending on the circumstances and the lawful basis we rely on for the relevant processing activity, you may have the following rights in relation to your personal data. These rights are not absolute and may be subject to conditions, limitations and exemptions under data protection law.
To be informed: to be given clear information about how we collect and use your personal data.
Access: to obtain confirmation that we process your personal data and request a copy of it, together with certain information about how it is used.
Rectification: to ask us to correct inaccurate personal data or complete information that is incomplete.
Erasure: to ask us to delete your personal data in certain circumstances. However, we may be required to retain your personal data in some circumstances.
Restriction: to ask us to restrict the processing of your personal data in certain circumstances.
Data portability: to receive personal data you provided to us in a structured, commonly used and machine-readable format, or ask us to transmit it to another controller, where the processing is based on consent or contract and carried out by automated means.
Object: to object to certain processing, including processing based on legitimate interest.
Automated decisions: where a significant decision about you is based solely on automated processing, to receive information about the decision and, where applicable, make representations, contest the decision and request human intervention.
Withdraw consent: where we rely on consent to process your personal data, you may withdraw your consent at any time. This will not affect the lawfulness of any processing carried out before you withdrew your consent.
Object to marketing: you have an absolute right to object at any time to the use of your personal data for direct marketing purposes.
If you wish to exercise any of these rights, you do not normally have to make a request in writing or pay a fee. However, we may charge a reasonable fee, or refuse to act on a request, if it is manifestly unfounded or excessive. We may ask for information to verify your identity or to clarify your request. We will respond without undue delay and normally within one month. In certain circumstances, we may extend this period by up to a further two months and will let you know if we need to do so.
To exercise a right, please contact us using the details below:
Yutree Insurance Ltd
15 Kings Court
Willie Snaith Road
Newmarket
Suffolk
CB8 7SG
T: 01638 660651
Making a complaint
If you are unhappy with the way in which we process your personal data, or how we have responded to a data subject rights request, you can raise a complaint. Please contact us using the above details in the first instance and we will endeavour to resolve the matter in a satisfactory manner. We will acknowledge your complaint within 30 days and will investigate and respond without undue delay.
If you remain dissatisfied, you have the right to raise your complaint to the Information Commissioner’s Office:
The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
T: 08456 30 60 60