Privacy Notice
Introduction
Welcome to CPP Secure Limited and Financial & Legal Insurance Company Limited’s joint privacy notice. This privacy notice provides details of how we will use, disclose, transfer and store personal information collected from you, in accordance with applicable data protection legislation, including the Data Protection Act 2018.
About us
CPP Secure Limited is a company registered in England and Wales with company number 10257192 whose registered office is at 6 East Parade, Leeds, United Kingdom, LS1 2AD (CPP Secure).
CPP Secure is registered as a Data Controller with the Information Commissioner’s Office with the registration number ZA224060. CPP Secure is registered with the Financial Conduct Authority with firm reference number 790304.
CPP Secure is part of the CPPGroup Plc group of companies (CPP Group). You can find out more about the CPP Group by visiting www.cppgroup.com.
Financial & Legal Insurance Company Limited is a company registered in England and Wales with company number 03034220 whose registered office is at No.1 Lakeside Cheadle Royal Business Park, Cheadle, Cheshire, England, SK8 3GW.
Financial & Legal Insurance Company Limited is registered as a Data Controller with the Information Commissioner’s Office with the registration number Z561011X. Financial & Legal Insurance Company is authorised by the Prudential Regulations Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority under firm reference number 202915.
This privacy notice applies to customers making a claim under their product guarantee (you, your). CPP Secure acts as intermediary for Financial & Legal Insurance Company Limited (the “Insurer”) who provide the insurance policy that supports the product guarantee. CPP Secure is also appointed by the Insurer for the provision of extended warranty assistance services.
If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact us using the details set out below.
CPP Secure acts as joint controller with the Insurer (together “us, we, our”).
Contact details
You can contact CPP:
· by post at: CPP Secure Limited, Data Protection, 6 East Parade, Leeds, United Kingdom, LS1 2AD; or
· by email at: DataPrivacy@cpp.co.uk
You can contact the Insurer:
· by email at: info@financialandlegal.co.uk
What personal information we collect and why
We will collect information about you when you make a claim under your product guarantee and are entitled to appliance repair services as a result.
We may obtain your personal information directly from you or from the third party that we appoint to provide the appliance repair service.
We may obtain further information in any communication that you send to us including the communication content and metadata associated with the communication (if applicable) and any other personal information that you choose to send to us.
We may obtain the following personal information about you:
|
Personal data type |
Source (data subject or any other organisation) |
|
Your name |
CPP’s third party appliance repair service provider |
|
Your address |
CPP’s third party appliance repair service provider |
|
Your contact details including your email address or telephone number |
CPP’s third party appliance repair service provider |
|
Information contained in or relating to any communication that you send to us |
You |
Where we need to collect and use personal information by law, or under the terms of your guarantee and you fail to provide that information when requested, we may not be able to perform the services.
How your personal information is used
We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:
§ Where we need to provide claims handling services.
§ Where we need to handle complaints.
§ Where we need to comply with a legal obligation.
Set out below, in a table format, is a description of all the ways we use your personal information, and which of the legal bases we rely on to do so.
|
Purpose/Activity |
Lawful basis for processing |
|
To provide claims handling services and process any claim |
Necessary for the performance of the functions or services of the claims handling services |
|
To process any complaints |
Necessary for the performance of the functions or services |
|
Internal record keeping |
Necessary for our legitimate interests (for running our business) Necessary to comply with a legal obligation |
|
To improve products and services |
Necessary for our legitimate interests (to develop our business and inform our marketing strategy) |
|
Statistical analysis |
Necessary for our legitimate interests (to study statistical trends within the business, to develop our business and inform our marketing strategy) |
|
Fraud prevention |
Necessary to comply with a legal obligation |
|
Debt collection |
Necessary for our legitimate interests (to recover debts due to us) |
Who your personal information might be shared with
CPP may share your personal information with other organisations as necessary, these are:
§ The Insurer, approved suppliers and service providers (which will include other companies within the CPP Group which provide services to us) where this is reasonably required to deal with your claim or provide services on our behalf. These suppliers may have access to personal information needed to perform their functions but are not permitted to share or to use such information for any other purpose.
§ Third parties where this is necessary to comply with any statutory, legal or regulatory obligations.
§ Other companies within the CPP Group e.g. to the extent needed for proper management and parental analysis and decision making.
The Insurer may share your personal information with other organisations as necessary, these are:
How long your information is held
We will hold your information for 7 years from the point of your claim.
International transfers
Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it. We only transfer your personal data to countries in the EEA.
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.
Data security
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Your rights under Data Protection legislation
Under certain circumstances, by law you have the right to:
· Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
· Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected. If you think any information we have about you is incorrect or incomplete, please contact us as soon as you can using the contact details set out below. We will correct or update any information as soon as possible.
· Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
· Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
· Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
· Request the transfer of your personal information to another party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, you can contact CPP:
· by post at: CPP Secure Limited, 6 East Parade, Leeds, United Kingdom, LS1 2AD;
· by email at: DataPrivacy@cpp.co.uk
You can contact the Insurer:
· by post at: Compliance Department, Financial & Legal Insurance Company Limited, No.1 Lakeside, Cheadle Royal Business Park, Cheadle, Cheshire, SK8 3GW; or
· by email at: info@financialandlegal.co.uk
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
We will try to respond to all legitimate requests within one month from the date of your request. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (see www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.