Data Protection Policy

1. Purpose and status

This policy sets the governance standard for the handling of personal information by Cambridge Corporate Consultants trading as ClaimSaveUK. It supports compliance with the UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations where applicable, the Data (Use and Access) Act 2025 as it affects data-protection law, and applicable FCA requirements. It must be read with the public Privacy Policy, Cookie Policy, information-security controls, retention schedule, records of processing activities, incident procedure, DPIAs and contracts. Where law or binding regulatory requirements impose a higher standard, that requirement prevails.

2. Scope

This policy applies to directors, employees, workers, contractors, temporary staff and any person with authorised access to ClaimSaveUK information or systems. It applies to personal data in electronic, paper, audio, messaging, CRM, portal, analytics, security-log and backup environments and to processing carried out by approved processors on our behalf.

3. Roles and accountability

Cambridge Corporate Consultants is the controller where it determines the purposes and means of ClaimSaveUK processing. The business owner/senior management is accountable for providing resources and oversight. A designated privacy lead must maintain the compliance framework, advise on rights requests, breaches, DPIAs, retention and supplier due diligence, and escalate material risks. All authorised users are personally responsible for following this policy and reporting suspected incidents promptly. Whether a statutory Data Protection Officer is required must be assessed and documented; the title DPO must not be used merely as a convenience if the statutory role has not been established.

4. Data-protection principles

Personal data must be processed lawfully, fairly and transparently; collected for specified, explicit and legitimate purposes; adequate, relevant and limited to what is necessary; accurate and kept up to date where necessary; kept in identifiable form no longer than necessary; and protected by appropriate technical and organisational measures. Cambridge Corporate Consultants must be able to demonstrate compliance with these principles.

5. Lawful basis and purpose limitation

Every material processing activity must have a documented purpose and UK GDPR lawful basis before processing begins. Where legitimate interests are relied upon, an appropriate balancing assessment must be completed where required. Consent must be freely given, specific, informed and unambiguous where consent is the basis, recorded so it can be demonstrated, and as easy to withdraw as to give. Personal data must not be repurposed incompatibly without a documented assessment, updated transparency information and any additional lawful basis or consent required.

6. Special category and criminal-offence data

Where a claim journey requires health or other special category data, both an Article 6 lawful basis and an applicable Article 9 condition must be identified and documented. Where reliance on a condition under the Data Protection Act 2018 requires an appropriate policy document, that document must be maintained. Criminal-offence data must not be processed unless an appropriate legal basis and DPA 2018 condition are documented. Collection must be minimised to what the relevant claim or compliance purpose genuinely requires.

7. Transparency

Individuals must receive clear privacy information at the appropriate time. The public Privacy Policy must accurately reflect actual processing, data sources, purposes, lawful bases, recipients, international transfers, retention, rights and any relevant automated processing. Before a claim is transferred, ClaimSaveUK must identify the actual proposed receiving FCA-authorised or SRA-regulated firm and provide the applicable privacy, regulatory, complaints, fee and transfer disclosures.

8. Data minimisation and ClaimSaveUK retention model

ClaimSaveUK must not collect information merely because it may be useful later. The reusable customer profile is limited to the approved fields required for pre-population and is currently configured for a maximum of 365 days, subject to any documented legal or regulatory requirement. Completed substantive claim answers are designed not to remain with ClaimSaveUK after successful transfer to the named receiving firm, except where a specific lawful retention requirement applies. A limited transfer/compliance audit record may be retained to demonstrate disclosures, customer instruction, recipient, timestamp and related accountability evidence.

9. Retention and secure disposal

A documented retention schedule must identify record categories, owners, retention periods or objective criteria, legal/regulatory rationale and disposal method. Records must be reviewed and securely erased, anonymised or put beyond use when retention is no longer justified. Legal holds, complaints, investigations or regulatory requirements may suspend routine deletion, but the reason and scope must be recorded. Backup deletion must follow the approved backup lifecycle and data that cannot immediately be erased must be protected from operational use until overwritten.

10. Individual rights

Processes must support the rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent and rights relating to automated decision-making where applicable. Requests must be recognised regardless of the channel used, logged promptly, identity verified proportionately and answered within the statutory timeframe. Extensions or refusals may only be used where legally permitted and must be documented and explained. Direct-marketing objections must be acted on without delay.

11. Children and vulnerable individuals

ClaimSaveUK journeys must be designed for the intended audience. If processing involving children or vulnerable individuals is proposed, additional fairness, accessibility and risk controls must be assessed before launch. Vulnerability must never be exploited for marketing, sales or transfer decisions.

12. Data protection by design and default

Privacy and security requirements must be considered from the earliest stage of new products, claim types, integrations, CRM changes, AI functionality, tracking, marketing campaigns and supplier changes. Default settings must minimise collection, access, sharing and retention. Changes must not go live merely because they are technically possible; the business must document necessity, proportionality and controls.

13. DPIAs

A Data Protection Impact Assessment must be completed before processing likely to result in high risk to individuals. DPIA screening is also required for material new technology, systematic monitoring, large-scale or sensitive processing, significant profiling or matching, novel AI uses, or combinations of data that materially increase risk. A DPIA must describe the processing, assess necessity and proportionality, identify risks and record mitigations. If high residual risk cannot be reduced, the ICO must be consulted before processing starts where the law requires prior consultation.

14. Automated processing and AI

Rules-based Smart Check or AI-supported functionality must be subject to documented purpose, data-minimisation, security, accuracy and human-oversight controls. ClaimSaveUK must not introduce solely automated decisions producing legal or similarly significant effects without a specific legal assessment and the safeguards required by law. AI providers must not receive claim contents, special category information or customer identifiers unless specifically approved, contractually controlled, necessary for the documented purpose and reflected in privacy information.

15. Security and access control

Access to personal data must follow least-privilege and need-to-know principles. Appropriate controls include strong authentication and MFA for privileged/partner access, encryption in transit and at rest where appropriate, secure secret management, logging, patching, malware protection, vulnerability management, backups and restore testing, segregation of environments, secure development practices and periodic access reviews. Shared accounts are prohibited unless technically unavoidable, specifically approved and compensating controls are documented.

16. Personal data breaches and incidents

Any suspected loss, unauthorised disclosure, access, alteration, destruction, ransomware event, misdirected communication or security weakness involving personal data must be reported immediately through the incident process. All personal data breaches must be documented, including facts, effects, risk assessment and remedial action. Where a breach is likely to result in a risk to individuals' rights and freedoms, notification to the ICO must be made without undue delay and, where feasible, within 72 hours of awareness. Where a breach is likely to result in a high risk to individuals, affected people must also be informed without undue delay unless a lawful exception applies.

17. Processors, suppliers and GPT Legal Limited

Processors may only be appointed after proportionate due diligence establishes sufficient guarantees of data protection and security. A written Article 28-compliant contract must govern processing, including documented instructions, confidentiality, security, sub-processors, assistance with rights/breaches/DPIAs, deletion or return at the end of services, and audit rights. Processor performance and contracts must be reviewed periodically. GPT Legal Limited's technology/domain support must operate under the actual documented controller/processor arrangement; this policy does not itself determine the legal role if the facts of processing differ.

18. Receiving FCA/SRA partners and data sharing

Receiving partners must pass the approved activation and due-diligence process before live customer data is transferred. Regulatory identity and permissions must be verified against the relevant official register where applicable, rather than accepted solely from partner-supplied information. The transfer must be limited to the named partner and the data necessary for the relevant claim. Data-sharing arrangements must document purposes, roles, security, complaints, retention and responsibility for rights requests. Partners acting as independent controllers are responsible for their subsequent processing under their own privacy notices.

19. International transfers

Restricted transfers outside the UK may take place only after the destination, recipient and transfer mechanism have been assessed. Where required, use UK adequacy regulations, the International Data Transfer Agreement, UK Addendum or another lawful safeguard, together with a transfer risk assessment and supplementary measures where appropriate. International transfer arrangements must be recorded and reviewed when circumstances or law change.

20. Marketing, PECR and suppression

Service communications must be distinguished from direct marketing. Electronic marketing must comply with applicable UK GDPR and PECR requirements and any changes introduced by legislation. Marketing consent, where required, must be separate from claim administration and partner-transfer confirmation. Opt-outs and objections must be honoured promptly and appropriate suppression records may be retained to ensure a person is not contacted again contrary to their choice.

21. Cookies and analytics

Non-essential storage/access technologies and analytics must be controlled in accordance with applicable law and current ICO guidance. Claim form contents, substantive claim answers and direct customer contact information must not be deliberately sent to Google Analytics. Analytics configuration, event names and URLs must be reviewed to prevent accidental disclosure of personal or sensitive information.

22. Records of processing and accountability evidence

The business must maintain records of processing activities where required and sufficient supporting documentation to demonstrate compliance. This includes data maps, lawful-basis records, legitimate-interest assessments where used, consent evidence, retention schedules, DPIAs, processor and data-sharing contracts, supplier reviews, international-transfer assessments, breach records, rights-request logs, training records, access reviews, audit evidence and policy approvals.

23. Accuracy and data quality

Reasonable steps must be taken to keep personal data accurate for the purpose for which it is used. Individuals must have a practical way to correct information. Data known to be inaccurate must not be used to make material decisions or transfers until corrected or appropriately qualified.

24. Training, confidentiality and acceptable use

Personnel with access to personal data must receive data-protection and security training appropriate to their role before or promptly after access is granted and refresher training thereafter. Staff must be subject to confidentiality obligations and must not export, copy, photograph, email or otherwise move customer information to personal devices, personal email, unapproved cloud storage or unapproved messaging services.

25. Monitoring, audit and enforcement

Compliance with this policy must be reviewed through periodic audits, access reviews, supplier reviews, incident analysis and launch-readiness controls. Material non-compliance must be escalated to senior management and remediated. Deliberate or reckless misuse of personal information may result in access removal, disciplinary or contractual action and referral to regulators or law enforcement where appropriate.

26. Complaints and regulatory cooperation

Privacy complaints must be logged, investigated fairly and linked to the relevant rights, breach or complaint process. Individuals retain the right to complain to the Information Commissioner's Office. Cambridge Corporate Consultants must cooperate appropriately with the ICO, FCA and other competent authorities and preserve relevant evidence where an investigation or complaint is underway.

27. Policy ownership, approval and review

This policy is owned by Cambridge Corporate Consultants. Senior management must formally approve the production version and confirm the named privacy owner, actual processor arrangements, retention schedule and supporting procedures before relying on it as evidence of operational compliance. It must be reviewed at least annually and sooner after a significant incident, new processing purpose, new technology, new partner model, material supplier change, or relevant change in law, FCA rules or ICO guidance. Superseded versions must be retained in accordance with the governance retention schedule.

28. Related documents

Related controls include the ClaimSaveUK Privacy Policy, Cookie Policy, Complaints Procedure, Security information, Record of Processing Activities, retention schedule, data-breach response procedure, DSAR/rights procedure, DPIA procedure and templates, supplier/processor register, data-sharing agreements, international-transfer assessments, information-security policies and staff training records. Public-facing documents do not replace the internal operational evidence required to demonstrate compliance.