Castel Underwriting Agencies Limited (“Castel”, “we”, “our” or “us”) is registered in England and Wales under company number 07774336 with its Registered Office at 33 Gracechurch Street, London EC3V 0BT. We are authorised and regulated by the Financial Conduct Authority.
We are committed to protecting your personal data and complying with data protection laws. Please read this privacy policy carefully. It provides information about how we use personal data and the rights available to you under data protection laws.
Layered approach
We use a layered approach to delivering information about data protection through:
A brief privacy notice in policy documentation when we issue your policy, which will refer to this more detailed privacy policy;
This privacy policy accessible online;
The London Market Core Uses Information Notice.
This Notice provides further information on how personal data is used within the insurance market.
This privacy policy covers the following areas of our data protection and privacy practices:
1. Information we may collect about you
We may collect and process the following personal data about you:
Information provided to us through enquiry, application or claims forms, including:
Information such as your name, address or contact details;
Sensitive information (e.g. details of any criminal or fraudulent behaviour or medical information) obtained either through you or third parties;
We may maintain records of any correspondence with you including phone records;
Information we collect through cookies. Please see our cookies statement for further information.
2. Why we collect data
We are required by data protection laws to have a legitimate reason to process and use your personal data. The main purpose for processing your personal data is for the provision and performance of an insurance contract e.g. reviewing your application, setting you up as a policyholder, administration and maintenance of your insurance policy or in order to process a valid claim.
With regards to ‘Special Category’ data i.e. sensitive information, we must obtain your consent at the point of collecting your personal data (i.e. when you input your details online or when completing a form) in order to process the data unless exemption for insurance purposes is applicable. In some circumstances, if we do not have your consent to process your data, it may impact our ability to issue you with insurance cover or to handle any claims.
We may also gather personal data for the following purposes:
in order to prevent, identify and investigate fraud or any activity that is in the public interest;
to defend ourselves against or make any legal claims;
where we have lawful purpose for processing your data e.g. for maintaining our accounts and records, gathering market intelligence in order to develop and improve our products and services. We will ensure that the processing of your personal data does not affect your rights under applicable data protection laws;
to comply with a legal or regulatory obligation e.g. where we are required to maintain records of any transactions with you, or for compliance with international legal and regulatory
where we have an appropriate business need to use your information which does not cause any harm to your interests such as keeping you informed of our product range and providing you with market commentary.
3. Sharing and safeguarding your personal data
All personal data supplied to us is stored on secure servers and only accessed and used in line with our data protection policies and procedures. Your personal data will only be accessed by our employees or authorised third parties who require the information for their business purposes. In circumstances where it is necessary to share your personal data with a third party, there are contractual agreements in place to ensure the security and confidentiality of your personal data and the information will only be used for the specific purpose for which it has been provided to them.
Our group companies: We may share your personal data with our group companies, based in the UK, but only for the purposes laid out in this privacy policy and we will ensure the security of your personal data.
Authorised third parties: We may also be required to allow authorised third parties, including service providers and suppliers, access to your personal data, for the purposes stated in section 2 of this notice. Any data sharing with third parties will be in compliance with applicable data protection laws.
Governmental, legal and regulatory authorities: It may be necessary for us to share your personal data with financial and regulatory organisations (e.g. the Financial Ombudsman Service, the Financial Conduct Authority, the Information Commissioner’s Office) or law enforcement agencies (including courts) in order to assist them with enquiries, investigations or proceedings and ensure our compliance with our regulatory and legal requirements. As a financial services company, we are required to have certain processes in place with regards to anti-bribery and corruption, money laundering and fraud. If any criminal offence is detected or suspected, we may share data with third parties (e.g. law enforcement agencies, fraud prevention agencies, anti-money laundering agencies) in order to prevent crime or aid investigations if crime is identified. We may also access this data as part of our ‘Know Your Client’ procedures to establish the parties we are dealing with and when assessing a claim payment in order to prevent criminal offences.
International transfers: We (or third parties acting on our behalf) may store or process information that we collect about you in countries outside the European Economic Area (EEA). Where we make a transfer of your personal information outside of the EEA we will take the required steps to ensure that your personal information is protected. If you would like further information regarding the steps we take to safeguard your personal information, please contact us.
4. Retention of your personal data
We will only keep your personal data for as long as is reasonably necessary for the relevant purposes set out in this privacy policy or when we are obliged to do so in order to comply with legal or regulatory requirements. The amount of time we retain your data for depends on the nature of the personal data and what we require it for. When your personal data is no longer required, we will ensure it is securely deleted.
5. Your rights
Our policy complies with the EU General Data Protection Regulation. The law requires us to tell you about your rights and our obligations with regards to the processing and control of your personal data, however not all of the following may be applicable in our business dealings:
There are some circumstances where we may be required to restrict your rights in order to safeguard the public or our own interests.
For further information regarding your rights, please visit the Information Commissioner’s Office’s website or click on the links provided above.
6. Contact Us
If you have any questions regarding privacy or how we use personal data, you may contact our Data Protection Officer:
Data Protection Officer
Castel Underwriting Agencies Limited. 33 Gracechurch Street. London. EC3V 0BT.
7. Changes to our Privacy Policy
We may change our privacy policy from time to time and any changes will be displayed on this page. This privacy policy was last updated in November 2019.
8. Cookies Statement
Cookies may be used by the Website to allow us to recognise you and your preferred settings e.g. to store your ID and password for future sessions. This saves you from re-entering information on return visits to the Website. You have the option not to use this feature, in which event no cookies will be retained on your computer.
If the site has a secure log-in for our registered users, it may use a temporary ’session cookie’ in order to perform the secure login to our website. This cookie contains no personal information, just a long random number, and is deleted from your web browser when you exit the Website.
Temporary cookies are used in the transactional part of the Website to authenticate you as an authorised user after you have logged in.
Your browser may be capable of being programmed to reject cookies, or to warn you before downloading cookies, and information regarding this may be found in your browser’s ‘help’ facility.
Below is a table of all cookies on this website – their name, type, duration and purpose:
Functional and Required Cookies
We use some necessary cookies that allow visitors to navigate and use key features on our site
| Name | Type | Duration | Purpose |
|---|---|---|---|
| Crumb | Cookie | Session | Prevents cross-site request forgery (CSRF). CSRF is an attack vector that tricks a browser into taking unwanted action in an application when someone’s logged in. |
| RecentRedirect | Cookie | 30 minutes | Prevents redirect loops if a site has custom URL redirects. Redirect loops are bad for SEO. |
| squarespace-popup-overlay | localstorage | Persistent | Prevents the Promotional Pop-Up from displaying if a visitor dismisses it |
| squarespace-announcement-bar | localstorage | Persistent | Prevents the Announcement Bar from displaying if a visitor dismisses it |
| Test | Cookie | Session | Investigates if the browser supports cookies and prevents errors. |
| squarespace-likes | localstorage | Persistent | Shows when you've already "liked" a blog post. |
Analytics and Performance Cookies
We use Analytics and Performance cookies to collect information about how visitors interact with our site. These cookies collect information about the use of the website, such as pages visited, traffic sources, users’ interests, content management, and other website measurements.
| Cookie Name | Duration | Purpose |
|---|---|---|
| ss_cid | 2 years | Identifies unique visitors and tracks a visitor’s sessions on a site |
| ss_cvr | 2 years | Identifies unique visitors and tracks a visitor’s sessions on a site |
| ss_cvisit | 30 minutes | Identifies unique visitors and tracks a visitor’s sessions on a site |
| ss_cvt | 30 minutes | Identifies unique visitors and tracks a visitor’s sessions on a site |
| ss_cpvisit | 2 years | Identifies unique visitors and tracks a visitor’s sessions on a site |
| ss_cookieAllowed | 30 days | Remembers if a visitor agreed to placing Analytics cookies on their browser if a site is restricting the placement of cookies |
9. Your right to complain
Should you have any concerns regarding how we process your personal data, then you have the right to report your concern to the Information Commissioner’s Office. For more information, please visit their website.
