Introduction:

We are committed to ensuring your privacy is protected. Please take time to read this document carefully as it contains details of the basis on which we will process (collect, use, share, transfer) and store your information. You should show this notice to all parties related to any service or related insurance arrangement. If you have given us information about someone else, you are deemed to have their permission to do so. 

If you have any questions or need further information, our contact details can be found at the end of this notice.

Who we are

We are, Jensten Group Ltd and subsidiaries, operating across a number of brands and trading names. For more information on the Jensten Group, it’s subsidiaries and brands of companies please visit www.jensten.co.uk.  We will, at all times, treat all personally identifiable information strictly in accordance with The UK General Data Protection Regulations (“UK GDPR”), supported by the Data Protection Act 2018 (“DPA 2018”). 

How we collect your personal data

We typically collect personal data directly from you through telephone conversations, emails, letters, face-to-face interactions, and online communications. We may also collect information through online forms and quotation systems used for certain types of insurance policies. These services may be provided through websites operated by Jensten Group or by trusted third-party providers acting on our behalf. Where we administer claims on behalf of our policyholders, we may collect personal data through claim forms and related documentation where this is necessary to assess, manage, or process a claim.

What information we collect and how we use this information

We may collect, use, process, store, and share various types of personal data about you for the purpose of arranging and administering your insurance contract(s), managing and processing claims on behalf of policyholders and claimants, and/or providing risk management services, including the refunding of premiums where applicable. This processing is necessary for the performance of a contract and to deliver the services associated with your insurance arrangements. We may also use your information to arrange premium finance at your request.

We only collect data that is required for these purposes. The types of personal data we may process are categorised as follows:

Identity data:    Full name, previous names, title, date of birth, gender, NI number, passport number, driving licence number, vehicle registration number.

Contact data:     Email address, residential address, telephone numbers.

Financial data:  Bank details, payment card details.

Insurance data: Policy details, claims history, occupation, details of insured property, vehicles or assets, incident and accident information, claim circumstances, loss and damage information, and other information relevant to the underwriting, administration, investigation, assessment, defence, settlement, or management of insurance policies and claims.

Special category and criminal offence data: We may also request and process special category personal data, including information relating to your health or medical history, and information relating to criminal convictions, offences or alleged offences, where this is necessary for underwriting, claims handling, fraud prevention, or to meet legal and regulatory obligations.

Where we need to collect personal data under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you.  In this case we may have to cancel the insurance that you have in place, and we will notify you if this is the case.

Where a refund is due, we may use artificial intelligence (AI) technology to assist with the administration of customer refund.

AI may be used to identify and validate the bank account details we hold for you and to facilitate payment by BACS. Any use of AI is subject to appropriate oversight, security measures and safeguards to protect your personal information. If you do not wish for your refund to be processed using this function, please contact your local branch and we will arrange an alternative payment method for you.

Lawful basis

We will ensure data is processed lawfully, fairly and in an open and transparent manner and ensure appropriate security measures are in place against unauthorised or unlawful processing or accidental loss, destruction or damage using appropriate technical or organisational measures (such as restricting access to key people within our organisation for certain aspects of your information; and periodically checking the level of security we apply to prevent unauthorised use, accidental loss, or misuse of your information).

If you are providing personal data on behalf of a third party, you must provide them with a copy of this privacy notice and obtain any consent where we require it for the processing of their data.

Automated decision making and profiling

We do not undertake any solely automated decisions. In certain circumstances such as, when a quotation is requested, or changes are made to an existing policy or at each renewal of an insurance arrangement, any or all of our group companies’ assessment may involve an automated decision, based on your profile and risk criteria which is shared with third party insurers, to determine whether we are able to secure an insurance arrangement on your behalf. 

Profiling involves the automated processing of your personal data to assess certain characteristics, such as the products we believe may be relevant to you. This can include creating customer profiles. Currently, our use of profiling is unlikely to have any legal or similarly significant impact on you.

Individuals have the right not to be subject to solely automated decision making and profiling. You can object to us using an automated decision (See Your data protection rights section below). However, in those situations, when a quote is requested, it may prevent us from being able to arrange any insurance for you.

When processing personal data for profiling purposes, we will ensure appropriate safeguards are in place, ensuring:

1. processing is fair and transparent and provides meaningful information about the logic involved; as well as the significance and the envisaged consequences;
2. use appropriate mathematical or statistical procedures for the profiling;
3. appropriate technical and organisational measures are in place to enable inaccuracies to be corrected and minimise the risk of errors; and secure your personal data in a way that is proportionate to the risk to your interests and rights and prevents discriminatory effects.

For our quotation systems we may use external data from, insurance companies, credit agencies, Electoral Roll, etc. to help in decision-making on pricing and risk acceptance. This may be regarded as “profiling” as defined in the legislation.

As explained (1-3 above), we have safeguards in place in the event that this has a legal or similarly significant effect on individuals. We do not consider that our processing poses such risks, but you have rights to further information on these processes as explained in the Your data protection rights below.

Marketing

When marketing to you as an individual (including individual sole traders and partnerships), we may share your Personal Data with other companies in the Jensten Group so that they can provide you with information about their products and services. We will rely on the lawful basis of either your prior consent or legitimate interest to contact you, such as by phone, e-mail, push notifications, SMS text, or post, to tell you about products or services we have or are developing which we think may be of interest to you. 

Within the Jensten Group, we operate under a number of brands and you may receive such communications from the following of our owned brands and trading names. You can view a full list of our brands and trading names here.

You have the right at any time to stop us from contacting you for marketing purposes and may opt out at any time by contacting the DPO on the details below with your instructions.

We may also share limited information with specified Third Parties to gain feedback on our service to you, we do this under the basis of legitimate interest. Should we need to use your information for any other purpose we shall request your consent to do so.

Website analytics and advertising tracking

We may use website analytics and advertising technologies to understand how visitors interact with our websites and to measure the effectiveness of our marketing.

When you visit our websites, certain information about your interaction with the site is collected. This may include:

• Pages visited and navigation paths
• Interactions with quote journeys and purchases
• Transaction values and order references
• Device and browser information (e.g. browser type, screen size, language)
• Approximate geographic location derived from your IP address

This information is used to improve our website, optimise our marketing activity, and better understand customer behaviour.

We process this data via a secure server environment hosted in the United Kingdom (Google Cloud Platform, London region). When you interact with our website, data is first sent to our controlled server environment, where it is evaluated and filtered before being shared with third parties. Only the information necessary for analytics and advertising measurement is forwarded. This allows us to control what data is shared and to minimise the amount of information provided to external partners.

Our systems are designed to ensure that directly identifiable personal data (such as your name, email address, phone number, policy numbers, or financial details) is not included in analytics or advertising data transfers.

Further information about the cookies and similar technologies used on our website, including their purpose, duration and providers, can be found in our Cookie Policy. Analytics and marketing cookies will only be used where you have provided your consent through our cookie preference centre.

We share limited tracking data with the following organisations:

• Google LLC (Google Analytics and Google Ads) — to understand how visitors use our website and to measure the effectiveness of our advertising
• Meta Platforms, Inc. (via Meta’s Conversions API) — to measure the effectiveness of advertising on Meta’s platforms

The data shared typically includes event data, page views, conversion information (such as quote completions or purchases), and cookie identifiers (such as _fbp and _fbc for Meta). It does not include directly identifying personal data such as your name or email address.

The following organisations support our website tracking infrastructure:

• Google LLC (Google Cloud Platform) — Provides hosting infrastructure for our server environment (London, UK)
• Google LLC (Google Analytics and Google Ads) — Provides analytics and advertising measurement services
• Meta Platforms, Inc. — Provides advertising measurement services via its platforms, including through the Conversions API

All third parties are subject to contractual obligations to process data securely and in accordance with applicable data protection laws.

Data Controller & Data Processor

The contractual arrangements we have in place with our suppliers (e.g. insurance companies, our client database software providers, lead generation, and similar providers of services to us, including other third-party companies who use our services), are governed by and shall be deemed to operate strictly in accordance with the terms of such contracts. Importantly, from your perspective, these contracts set out to define how data will be processed between us, including circumstances when we act as a controller,   joint controller or processor, as is required by the UK GDPR.

Use & Storage of your Information Overseas

We will never knowingly transfer, store, or process information about you or an individual, outside the Europe an Economic Area (EEA). In the event that we are compelled to transfer your information outside the EEA (e.g. because it is an insurance arrangement with an Insurance Company who is outside the EEA or part of a larger group of companies who pass information outside the EEA) it shall be in compliance with the conditions for transfer set out in the GDPR and or restricted to a country which is considered to have adequate data protection laws. All reasonable steps shall typically have been undertaken to ensure the firm to which information is being transferred has suitable standards in place to protect such information.

What we will not do with your information 

Unless required to do so by law, or for other similar reasons, other than those outlined (see What information we collect and how we use this information ) we will never otherwise share personal information without legal basis or without ensuring the appropriate care and necessary safeguards are in place; we will in any other event ask for your consent to share that information and explain the reasons.

How long we will keep personal data

We will only keep and / or maintain information about an individual for as long as is necessary in providing our products and services, or for compliance with a legal or regulatory obligation, including our legitimate interests or the interests of the controller where we are the processor.

This means, we will only keep information that is necessary so that we can sufficiently deal with administrative issues, queries, claims and / or for compliance with legal reasons; usually we will keep information for a minimum retention period of 7 years after cessation of a product or service we have provided. For Employer’s Liability and certain other specific classes of business that require it, we will retain data indefinitely. 

Your data protection rights

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information that we hold about you.

Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

Rights to object to automated decision making – You have the right not to be made subject to a decision made solely by automated means where it is not necessary for the performance of a contract or that could have a legal or significant effect on you. If you believe a decision has been made solely based on automated processes, you may contact us to request manual intervention.

You are not usually required to pay any charge for exercising your rights, but we do reserve the right to make an administrative charge for Subject Access Requests if requests are deemed manifestly unfounded or excessive. If you make a request, we have one month to respond to you, but we are permitted by the UK GDPR to extend this by a further two months if the request is sufficiently complex or if you submit a number of requests.

Please contact us at the details provided below if you wish to make a request.

Data Protection Complaints Procedure

In addition to your rights outlines above, we operate a formal Data Protection Complaints Procedure in line with the applicable data protection legislation, including the UK GDPR and the Data (Use and Access) Act 2025 (DUAA).

This process ensures that:

• all complaints relating to the use of your personal data are handled fairly, consistently, and without undue delay;
• complaints are acknowledged and investigated appropriately; and
• you are kept informed of the progress and outcome of your complaint.

Further details of this process can be obtained by contacting our Data Protection Officer using the details below.

Changes to the Privacy Notice and Your Duty to inform us of changes

This Privacy Notice will be updated from time to time and was last updated in September 2026

It is important that personal data we hold about you is accurate and current.  Please ensure that you keep us informed if your personal data changes during your relationship with us.

Data Protection Officer contact details:

If you have any cause for concern about our handling of personal information, please contact us using the details below:

Data Protection Officer, Jensten Group Limited, Coversure House Vantage Park, Washingley Road, Huntingdon, Cambridgeshire, PE29 6SR

Or email: DPO@jensten.co.uk

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, Helpline number: 0303 123 1113 and ICO website: https://www.ico.org.uk