1. WHO WE ARE

Claim Technology Ltd (company number 10744798) (“CTL, WE/US/OUR”) are committed to protecting and respecting your privacy.

This privacy policy explains how we collect, use, disclose and protect your personal data when you:

• visit our website;
• contact us directly; or
• interact with us in connection with a claim handled by one of our clients.

For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, we act either as:

• data controller in relation to personal data we collect and process for our own business purposes (for example, website enquiries and marketing); or
• data processor when we process personal data on behalf of our claims-handling clients, who are the data controllers in those circumstances.

Our registered office is at 71-75 Shelton Street, Covent Garden, London W1S 4RH.
ICO registration number: ZA293215.
If you have any questions about this policy or how we use your personal data, please contact us at:
Email: privacy@claimtechnology.co.uk

2. THE PERSONAL DATA WE COLLECT

We may collect and process the following categories of personal data, depending on the nature of our relationship with you:

2.1 Identity and Contact Data

• Name
• Postal address
• Email address
• Telephone number
• Date of birth

2.2 Claim-Related Data

• Information relevant to a claim you are pursuing or are otherwise involved in
• Correspondence and communications
• Supporting documentation provided by you or by our clients

2.3 Financial and Verification Data

• Limited financial information relevant to a claim
• Identification documents only where strictly necessary for verification, fraud prevention, or regulatory compliance

We do not store payment card details. Any payment processing is handled directly by PCI-DSS compliant third-party payment service providers.

2.4 Special Category Data

We do not routinely collect special category personal data. However, where required in connection with a claim, we may process information relating to physical or mental health.

2.5 Technical and Usage Data

• IP address
• Browser type and version
• Operating system
• Website usage data, cookies, and similar technologies

Where possible, technical data is aggregated or anonymised.

It is important that the personal data we hold about you is accurate and up to date. Please notify us of any changes.

3. HOW WE USE YOUR PERSONAL DATA AND LAWFUL BASES

We will only process your personal data where permitted by law. The purposes for which we use your personal data and the lawful bases relied upon are set out below.

3.1 Contractual Necessit

• To provide services requested by you or by our clients
• To manage and progress claims

3.2 Legitimate Interests

• To perform our contractual obligations to our clients, including claims administration and case management
• To prevent fraud and misuse of our services
• To maintain accurate business records and respond to enquiries or complaints
• To administer, monitor, and improve our website and services

We have assessed that these interests do not override your rights and freedoms. We do not rely on legitimate interests where the impact on individuals would be disproportionate or unexpected.

3.3 Legal Obligations

• To comply with legal, regulatory, and tax obligations
• To prevent fraud and comply with court or regulatory requirements

3.4 Consent

• For non-essential cookies
• For electronic marketing communications where required by law

You may withdraw consent at any time, and this will not affect the lawfulness of processing carried out before withdrawal.

3.5 Special Category Data

Where health or medical data is required in connection with a claim, we process it on the basis that it is necessary for the establishment, exercise, or defence of legal claims (Article 9(2)(f) UK GDPR). In limited circumstances, we may also rely on your explicit consent.

Special category data is subject to enhanced safeguards, including restricted access, heightened confidentiality obligations, and retention limits. Such data is only accessible to authorised personnel who require it for legitimate claim-related purposes.

4. IF YOU FAIL TO PROVIDE PERSONAL DATA

Where we need to collect personal data by law or under a contract and you fail to provide it, we may be unable to provide services or progress a claim.

5. MARKETING COMMUNICATION

We may contact you with information about our services where permitted by law.

• Electronic marketing will only be sent where you have consented or where the soft opt-in applies.
• You can opt out of marketing at any time by using the unsubscribe link or contacting us.

We will continue to send service-related communications where necessary.

6. COOKIES

Our website uses cookies and similar technologies. Further information about the cookies we use and how to manage them is available in our cookie policy.

7. DATA SHARING

We may share your personal data with:

• Our claims-handling clients (where we act as processor
• Professional advisers
• IT and system providers
• Regulatory bodies, courts, and law enforcement where required

Third parties are only permitted to process your personal data in accordance with our instructions and applicable data protection laws.

8. INTERNATIONAL TRANSFERS

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including:

• UK adequacy regulation
• The UK International Data Transfer Agreement (IDTA)
• The UK Addendum to the EU Standard Contractual Clauses

We document international transfers and the safeguards relied upon, and we keep these arrangements under review. Transfer risk assessments are carried out where required to ensure that personal data continues to receive an adequate level of protection.

9. DATA SECURITY

We have implemented appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, or disclosure.

These measures include access controls, staff confidentiality obligations, and information security policies appropriate to the nature of the data we process. We also maintain internal governance measures, including data protection impact assessments and contractual controls with processors, where required.

We maintain procedures to manage and report personal data breaches in accordance with legal requirements.

10. DATA RETENTION

We retain personal data only for as long as necessary for the purposes for which it was collected. Retention periods are determined by reference to legal limitation periods, regulatory requirements, and guidance from the ICO
Typical retention periods include:

• Claim-related data: up to 6 years after claim closure (or longer where legally required)
• Enquiry data: up to 12 months
• Marketing suppression records: retained indefinitely

We maintain a documented retention and disposal policy and carry out periodic reviews to ensure data is not retained for longer than necessary. Further details are available on request.

11. YOUR RIGHTS

You have rights under UK GDPR, including the right to:

• Access your personal dat
• Rectify inaccurate data
• Request erasure
• Restrict or object to processing
• Data portability (where applicable)
• Withdraw consent

Requests can be made by contacting privacy@claimtechnology.co.uk. We aim to respond within one month.

You also have the right to lodge a complaint with the Information Commissioner’s Office (www.ico.org.uk).

12. AUTOMATED DECISION-MAKING

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

13. CHANGES TO THIS POLICY

We may update this policy from time to time. The latest version will always be available on our website.

14. CONTACT US

If you have any questions or concerns about this privacy policy or how we handle your personal data, please contact:

Email: privacy@claimtechnology.co.uk

We encourage you to contact us first before raising concerns with the ICO.