Privacy Policy
About us
Bastion Insurance Services Ltd trade under brand names including Tinhat, Devicecover and
Freshcover. We provide insurance and associated services to our customers, often working with
other insurance companies to provide you with your insurance policy.
We are committed to protecting your privacy and take great care to ensure your information is kept
safe and secure. This policy explains how we will collect, store, use and share your personal
information in compliance with the General Data Protection Regulation (GDPR).
Who do we collect information about?
We collect information about the following types of individuals:
• Previous, current and prospective customers/policyholders
• Person’s authorised to speak to us on behalf of a customer or policy holder
• Experts instructed in relation to claims
• Users of websites owned by Bastion Insurance Services Ltd
• Business Partners
When do we collect information about you?
We collect information about you when:
• When we are providing you with a quotation when you apply for, amend or renew a policy
• You submit a claim under a policy
• When you contact us (by phone, email, through our website or otherwise) such as to update
• or check your details, provide feedback, fill in forms or complete applications for insurance
policies or other goods/services
• When you register to use our website, subscribe to our services, search for a product, place
an order on our website, participate in discussion boards or other social media functions on
our website, leave any query or correspondence on our website, enter a competition,
promotion or survey or when you report a problem with our website or any other activity
undertaken with us.
• When you contact us to make a complaint.
What information do we collect about you?
The personal information that we collect about you will depend on your relationship with us.
If you provide personal information to us about other individuals you agree: (a) to inform the
individual about the content of this Privacy Policy; and (b) to obtain any consent where we indicate
that it is required for the processing of that individual’s personal data in accordance with this Privacy
Policy.
Below is a detailed list of the types of personal information we may collect and use about you:
• General information such as your name, address, date of birth, email address and phone
• number
• Details of previous policies or quotes between you and us.
• Financial information such as payment card or bank account information and information
which is pertinent the administration of the quote, policy or claim
• Personal description when necessary for the administration of the policy
• Details about you and your personal circumstances where this is appropriate in the
administration of your quote, policy or claim for example, information to allow us to identify
a potentially vulnerable customer, to record your marital status, occupation, home owner
status, as well as other information you (or a third party) may provide to us as part of the
quote, policy and/or claim administration processes whether through phone, email, letter,
or via a website, App, social media or online chat.
• Location at time of policy purchase
• Information relevant to the scope of the quote or policy such as gadget or bicycle type.
• We may collect information when you use our website including data that allows us to
monitor your preferences and how you use our website. This helps us to organise our
website content in order to improve your experience. The information we collect includes:
o Details of transactions you carry out through our website.
o Information that you provide by filling in forms on our website even if those forms
are not submitted.
o Technical information, including the Internet Protocol (IP) address used to connect
your device to the Internet, your login information, browser type and version, time
zone setting, browser plug-in types and versions, operating system and platform
• Information about your visit, including the full Uniform Resource Locators (URL) clickstream
to, through and from our website (including date and time).
• Products you viewed or searched for, page response times, download errors, length of visits
to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs),
and methods used to browse away from the page.
• We may use cookies to collect information about how our website is used. Please see our
Cookies Policy for more information about our use of cookies.
How do we collect your information?
We collect personal information in a number of ways, as detailed below:
• Directly from you or from someone else on your behalf by website, phone, email, on line
chat and paper documents.
• From your company website.
• From our records.
• From third parties (including brokers, aggregators, insurance companies, business partners,
• suppliers, payment and delivery services, third party claimants under a policy, advertising
• networks, analytics providers, search information providers and credit reference agencies).
• From other resources, for example, risk assessment models, pricing data, statistics and other
information from public databases, websites and other sources, including aggregator
websites.
• Other publicly available sources, including, but not limited to, Google Earth and social media.
• Through customer and broker surveys.
• Via insurance industry fraud prevention and detection databases, as well as sanctions
• screening tools.
• From government agencies such as HMRC and from professional regulators
What are the purposes for which information about you is used?
We may process your information for a number of different purposes. For each purpose we must
have a legal ground for such processing. When the information that we process is classed as special
category or sensitive personal information, we must have an additional legal ground for such
processing.
Whether you provide us with the information, or we collect information from you or we are
provided with information from other sources, we may use this information:
a) To evaluate your insurance application and provide (and follow up) a quote
Legal grounds:
Our having an appropriate business need to use your information to provide insurance, which does
not overly prejudice you.
Our providing your insurance contract.
Additional legal ground for sensitive personal information:
Either because the use of this information is necessary for the purpose of carrying on insurance
business as permitted by Data Protection Law, or because you have provided us with your explicit
consent.
b) To set you up as a policyholder including carrying out fraud, credit and anti-money laundering
checks
Legal grounds:
To carry out our obligations arising from any insurance contract entered into between you and us.
Additional legal ground for sensitive personal information:
Either because the use of this information is necessary for the purpose of carrying on insurance
business as permitted by Data Protection Law, or, because you have provided us with your explicit
consent.
The use is necessary for reasons of substantial public interest in preventing or detecting unlawful
acts.
—-
c) To evaluate your application and ability to pay for your policy by instalments (if applicable)
Legal grounds:
Such use is necessary in order to provide your insurance policy.
Additional legal ground for sensitive personal information:
Either because the use of this information is necessary for the purpose of carrying on insurance
business as permitted by Data Protection Law, or, because you have provided us with your explicit
consent.
—-
d) To provide and manage your insurance policy
Legal grounds:
Our having an appropriate business need to use your information to provide insurance which does
not overly prejudice you.
Our providing your insurance contract.
Additional legal ground for sensitive personal information:
Either because the use of this information is necessary for the purpose of carrying on insurance
business as permitted by Data Protection Law, or, because you have provided us with your explicit
consent.
—-
e) To provide and manage your claim (whether we are your insurers, we are acting for your insurer
or whether you are a third party making a claim against us or a third-party insurer for whom we
act)
Legal grounds:
Our having an appropriate business need to use your information to manage an insurance contract
and claim which does not overly prejudice you.
Our providing an insurance contract.
Additional legal ground for sensitive personal information:
Either because the use of this information is necessary for the purpose of carrying on insurance
business as permitted by Data Protection Law, or, because you have provided us with your explicit
consent.
—-
f) Communicating with you and resolving any complaints that you might have
Legal grounds:
Our providing your insurance contract.
Our having an appropriate business need to use your information to manage and respond to
complaints which does not overly prejudice you.
Additional legal ground for sensitive personal information:
Either because the use of this information is necessary for the purpose of carrying on insurance
business as permitted by Data Protection Law, or, because you have provided us with your explicit
consent.
The use is necessary in order for us to establish, exercise or defend our legal rights.
—-
g) To transfer to third parties for the purpose of providing you with the services required under
the insurance contract or other services which you have elected to receive from us in connection
with the insurance contract
Legal grounds:
Our providing the insurance contract.
Our providing other contracted services.
Additional legal ground for sensitive personal information:
Either because the use of this information is necessary for the purpose of carrying on insurance
business as permitted by Data Protection Law, or, because you have provided us with your explicit
consent.
h) To transfer to third parties where you have elected to enter into a contract with that third party
for separate services
Legal grounds:
You have provided your explicit consent to allow us to provide the third party with your details to
enable you to enter into a contract with that third party.
Additional legal ground for sensitive personal information:
You have provided your explicit consent to the provision of these additional services which
necessitate the transfer of sensitive personal information.
i) Prevention and detection of and investigating and prosecuting fraud. This might include sharing
your personal information with third parties such as the police, and other insurance and financial
services providers
Legal grounds:
Our providing your insurance contract.
Our having an appropriate business need to use your information to ensure fraud is detected which
does not overly prejudice you.
Additional legal ground for sensitive personal information:
Either because the use of this information is necessary for the purpose of carrying on insurance
business as permitted by Data Protection Law, or, because you have provided us with your explicit
consent.
The use is necessary for reasons of substantial public interest in preventing or detecting unlawful
acts.
j) Complying with our legal or regulatory obligations
Legal grounds:
The use is necessary in order for us to comply with our legal obligations.
Additional legal ground for sensitive personal information:
Either because the use of this information is necessary for the purpose of carrying on insurance
business as permitted by Data Protection Law, or, because you have provided us with your explicit
consent.
The use is necessary in order for us to establish, exercise or defend our legal rights.
k) Recover outstanding payments
Legal grounds:
Our having an appropriate business need to use your information in order to recover debts which
does not overly prejudice you.
Additional legal ground forsensitive personal information:
The use is necessary in order for us to establish, exercise or defend our legal rights.
l) To provide you, or permit selected third parties to provide you, with information about goods or
services we feel may interest you, including news updates and details of special offers (further
details are provided in the ‘Marketing’ section below)
Legal grounds:
You have provided your explicit consent which can be withdrawn at any time.
m) To improve our customerservice
Legal grounds:
Our having an appropriate business need to use your information in the improvement of our
customer service which does not overly prejudice you.
n) To measure the effectiveness of our advertising
Legal grounds:
Our having an appropriate business need to use your information to ensure our advertising is
effective which does not overly prejudice you.
o) To provide data analysis in order to assist us with the pricing of our products and detect market
trends
Legal grounds:
Our having an appropriate business need to use your information which does not overly prejudice
you.
p) To personalise your repeat visits to our website and to improve our website, including as part of
our efforts to keep our website safe and secure
Legal grounds:
Our having an appropriate business need to use your information which does not overly prejudice
you.
q) To notify you about changes to our services or products
Legal grounds:
Our having an appropriate business need to use your information to keep our customers up to date
with changes to our products or services which does not overly prejudice you.
r) To administer our websites and for internal operations, including troubleshooting, data analysis,
testing, research, statistical and survey purposes
Legal grounds:
Our having an appropriate business need to use your information to maintain our websites which
does not overly prejudice you.
s) To allow you to participate in interactive features of our services/website
Legal grounds:
Our having an appropriate business need to use your information to offer an interactive website for
customers which does not overly prejudice you.
t) For analytical purposes and to improve our products and services. Where possible we will
anonymise such information
Legal grounds:
We have a legitimate business need to use your personal information for services improvement.
u) Providing improved quality, training and security (for example, with respect to recorded or
monitored phone calls to our contact numbers); technology may include voice analytics
Legal grounds:
We have a legitimate business need to provide secure and quality services
Additional legal ground for sensitive personal information:
Either because the use of this information is necessary for the purpose of carrying on insurance
business as permitted by Data Protection Law, or, because you have provided us with your explicit
consent.
Who do we share the information we collect about you with?
Sharing with third parties
We may share your information with selected third parties, in order to offer services to you or to
perform any necessary functions on our behalf. This may include:
• Your relatives, executor or guardians (on your behalf where you are incapacitated or unable)
or other people or organisations associated with you such as your insurance broker
• Where you have named an alternative contact (such as a relative) to speak with us on your
behalf. Once you have told us your alternative contact, this person will be able to discuss all
aspects of your policy (including claims and cancellation) with us and make changes on your
behalf
• Our insurance partners such as brokers, other insurers, reinsurers or other companies who
act as insurance distributors
• Other third parties who assist in the administration of insurance policies such as another
insurance company if there has been an accident which requires a claim to or from that
insurance company
• We may share the personal information of any persons named on the policy with third
parties to obtain information which may be used by us to inform its risk selection, pricing
and underwriting decisions
• Other third parties you have asked us to engage with
• Claims administrators
• Solicitors
o To manage legal cases brought against us or on our behalf
o To manage regulatory investigations
• Business partners
o Software providers; who provide the technical infrastructure to allow us to provide
your quote, policy and claims administration
o Aggregators (when you have used their website to obtain our quote): to verify the
policies obtained through their sites
o Clients: for whom we provide insurance policy and administration
o Companies you have agreed may receive your information to allow you to enter into
a contract with them (for example, reward schemes or claims management
companies)
• Suppliers
o Companies engaged by us to provide contracted services. This is a wide ranging list
of companies and their use will depend upon the circumstances. For example:
▪ Printing of invoices and policy documents
▪ To allow us to record our incoming and outgoing calls with you
▪ In the event of a claim we may engage the services of gadget/device repair
companies, bicycle mechanics
o Companies engaged by us to provide aspects of our communications with you (for
example, web hosting, online chat provider)
• Credit reference agencies
• Finance providers
• Survey companies
• Data analytics advisors
• Enquiry agents/Counter Fraud Investigators
• Debt collectors
• Query search engine operators
• Where you have given your explicit consent to third parties for marketing purposes
Disclosure of your personal information to a third party will only be made where the third party has
agreed to keep your information strictly confidential and shall only be used for the specific purpose
for which we provide it to them.
We may also share your information with:
• Search engine operators who can assist us in the improvement of our website
• Prospective buyers, in the event that we sell any business or assets
• Regulators and other authorised bodies, whenever we are required to do so by law We
believe that such disclosure is necessary in order to assist in the prevention or detection of
any criminal action (including fraud) or is otherwise in the overriding public interest.
We may also share your information with other insurance industry databases.
Claims checks
We may share your information with organisations that can check your claims history.
What is our approach to sending information overseas?
We may send your data outside the United Kingdom (UK) if we are required to do so for a joint data
controller (for example if an insurer is based overseas).
We seek to ensure that data which is processed on our behalf as data controller is retained within
the UK but this is sometimes difficult (for example a UK supplier may have a server based outside of
the UK).
If we make a transfer of your personal information outside of the UK we will take the required steps
to ensure that your personal information is protected. Such steps may include placing the party we
are transferring information to under contractual obligations to protect it to adequate standards.
How long do we keep personal information for?
We will only keep your personal information for as long as reasonably necessary to fulfill the
relevant purposes set out in this Privacy Policy and in order to comply with our contractual, legal
and regulatory obligations.
We have implemented a Document Retention Policy which records of details how long various types
of information should be retained. The Policy is reviewed on a regular basis to ensure that it aligns to
current legal and regulatory requirements. The retention periods vary depending upon the
circumstances of an individual matter but in general our retention periods for customer facing
documentation can be set out as follows:
Quote information – 3 months (unless marketing consent received from you in which case 13
months)
Policy documents – 7 years from cancellation of policy
Claims documents – 7 years from date of last settlement/order
Complaints – 7 years from the complaint being resolved or the policy retention period whichever is
the longer
If you would like further information regarding the periods for which your personal information will
be stored, please see the contact details outlined in the “How to Contact Us” section below.
Automated decision making
Fraud prevention
We use computers to automatically run fraud and money-laundering checks which helps us to
decide:
• Whethersomeone might pose a fraud or money-laundering risk
• Whether their behaviour is similar to that of known fraudsters or money launderers
• Is inconsistent with information we already have about them
• If we think they are hiding their true identity
Auto Renewal
We will ask you when you purchase your policy if you would like to opt in to auto-renewal. However,
even if you opted in at this point, you have the right to opt out at any point.
What marketing activities do we carry out?
You are in control of whether we can use your personal information for marketing. We are
committed to only sending you marketing communications that you have clearly expressed an
interest in receiving.
When we engage with you, we will ask you (on our website, by email or when we speak to you)
whether you want us to contact you with marketing information that we think might interest you
and if so by what method (email, phone, post, SMS). Depending on the options offered and that you
select the marketing could be about:
• Our products and services,
• Products or and services from selected third parties.
We may send this information to you directly or via third parties such as search engine operators
and marketing companies on our behalf. If you wish to unsubscribe from marketing then you may do
so at any time by following the unsubscribe instructions that appear in all marketing
communications. Otherwise in respect of marketing from us, you can always contact us using the
details set out in your policy documentation to update your contact preferences or details. Although
this will stop marketing communications we will of course continue to send you service related (nonmarketing) communications where necessary.
Please note that there is no personal information used in our online ad campaigns so you will need
to check your browser or social media settings to avoid seeing these.
Your rights
Under data protection law you have certain rights in relation to the personal information that we
hold about you. You may exercise these rights at any time by contacting us using the details set out
in the “How to Contact Us” section of this Privacy Policy.
Please note:
Bastion Insurance Services Limited Privacy policy_15052024
• In some cases we may not be able to comply with your request (e.g. we might not be able to
delete your data) for reasons such as our own obligations to comply with contractual, legal
or regulatory requirements. However, we will always respond to any request you make and
if we can’t comply with your request, we will tell you why.
• In some circumstances exercising some of these rights (including the right to erasure, the
right to restriction of processing) will mean we are unable to continue providing you with
cover under the policy and may therefore result in the cancellation of the policy. You will
therefore lose the right to bring any claim or receive any benefit under the policy, including
in relation to any event that occurred before you exercised your right of erasure, if our
ability to handle the claim has been prejudiced. Your policy terms and conditions set out
what will happen in the event your policy is cancelled. For some policies no refunds will be
payable on cancellation, for other products a refund may be payable.
The right to access your personal information
You have the right to access a copy of the personal information we hold about you and certain
details of how we use it. There will not usually be a charge for dealing with these requests.
The right to rectification
We take reasonable steps to ensure that the personal information we hold about you is accurate and
up to date. However, if you do not believe this is the case, you can ask us to update or amend it.
The right to erasure
In certain circumstances, you may ask us to erase your personal information.
The right to restriction of processing
In certain circumstances, you are entitled to ask us to stop using your personal information.
The right to data portability
In certain circumstances, you have the right to ask that we transfer any personal information that
you have provided to us to another third party of your choice.
The right to object to marketing
You can ask us to stop sending you marketing messages at any time.
The right not to be subject to automated decision-making (including profiling)
You have a right not to be subject to automated decision-making (as described above) and where
automated decision-making is used in the assessment of your application or fraud prevention, you
can contact us to request that any declined decision is reconsidered. If you want to opt out of
automatic decision-making, let us know, although in some circumstances it may mean we can’t offer
you a quote or policy as some automated decisions are necessary to provide your insurance policy.
The right to withdraw consent
For certain uses of your personal information, we will ask for your consent. Where we do this, you
have the right to withdraw your consent to further use of your personal information.
The right to lodge a complaint with the ICO
Bastion Insurance Services Limited Privacy policy_15052024
You have a right to complain to the Information Commissioner’s Office (ICO) if you believe that any
use of your personal information by us is in breach of applicable data protection laws and
regulations.
More information can be found on the ICO’s website at: www.ico.org.uk/concerns.
Making a complaint will not affect any other legal rights or remedies that you have.
How we protect your information
We want you to have confidence in how we use and hold your data. We know that to achieve this
we must preserve the security and confidentiality of your personal information. We have therefore
developed a range of organisational, procedural and technical security measures designed to protect
your personal information from unauthorized use or disclosure. Examples of some of these
measures include:
• User and privileged account management including appropriate policies for password
complexity, length and history
• Auditing of system users and administrators
• Regular backup schedules and disaster recovery environment for key systems and services
• Secure file transfer methods are used to encrypt data
• Usage of data loss prevention tools within the Group
• Data breach detection: Security tools in place to detect unusual or abnormal activity
• Data breach investigation: Audit and logging tools used to investigate any potential or
reported breaches
• Data breach response: A plan that pulls together our compliance, legal and IT security teams
to ensure rapid assessment and mitigation of data breaches
Changes to our Privacy Policy
We keep our Privacy Policy under review and it is updated periodically. For example, those changes
may be due to government regulation, new technologies, or other developments in data protection
laws or privacy generally. You should check our website periodically to view the most up-to-date
Privacy Policy.
This Privacy Policy was last updated on: 15th April 202
How to Contact Us
Please contact us if you have any questions about our Privacy Policy or to exercise any of your
rights:
Data Protection Officer
Bastion Insurance Services Ltd,
Temple Court Mews,
109 Oxford Road
Oxford
OX4 2ER
Or by email to dataprotection@bastioninsurance.co.uk.
Where you have made the request by electronic means, the information will be provided to you by
electronic means where possible.
Other websites
Our website may contain links to other websites. This Privacy Policy only applies to our own
website so when you link to other websites you should read their own privacy policies. If this policy
conflicts with any written contract that we have with you then the written contract shall take precedence.
Complaints
If you have a complaint about how we use your information then please contact us at:
Data Protection Officer
Bastion Insurance Services Ltd,
Temple Court Mews,
109 Oxford Road
Oxford
OX4 2ER
You can also contact us by phone on 01865 818927, or by email using
dataprotection@bastioninsurance.co.uk.
If you have a complaint about the way in which your data has been processed, you can contact the
ICO at: www.ico.org.uk/concerns