Privacy Notice

Who are we and what do we do?

Castelan Limited is registered in England with Companies House, number 7637133 and is authorised and regulated by the Financial Conduct Authority registration number 572287. Castelan's registered office is: Alpha House, Sunnyside Road, Weston - super - Mare, BS23 3QY.

We arrange and administer your insurance policy. We collect information on you for the purpose of administering your policy and handling your claim on behalf of your insurer. 

What information do we collect about you?

To enable us to take the necessary steps to enter into a contract with you to provide the appropriate insurance products and services we may collect the following information:

• Name, date of birth, address, other contact details, occupation, financial information such as bank details, details of insured items or cover required including the location of those items where applicable, details of additional people who you are including on the proposal or policy
• Details of previous insurance cover
• Previous applicable claims history excluding personal injury details or medical conditions.
• Details about any claim being made under the insurance.
• Details of any complaint should there be a need to make one.

We may also collect Special Category information, which is sensitive personal information about you, and any additional people who you wish to be insured under the policy including:

• Information on your health when you are making a claim for sickness, accident or hospitalisation;
• Medical records to validate a claim should you be claiming for sickness, accident or hospitalisation;
• Information on your health where we consider a change to our procedures is likely to provide you a better customer outcome.

We will seek your consent either in writing or verbally when collecting any of the above.

You, as the purchaser, will be the primary insured and will be our primary point of contact in relation to any policies purchased.

You:

• Will have access to all documentation, information and personal data relating to all Insured on this policy.
• Can make any change to all parts of the policy.
• Can notify us if you need to make a claim.
• Can cancel the policy.
• Can raise a complaint concerning the policy or a claim.

Any other person named on the policy can:

• Notify us of a claim.
• Raise a complaint concerning the policy or a claim.

If a person has been given permission to handle the insured's affairs, they can:

• Notify us of a claim on your behalf.
• Instruct decisions to be made in respect of the claim
• Cancel the policy on your behalf.
• Raise a complaint concerning the policy or a claim.

We require prior permission from you in writing for this arrangement unless it is explicitly allowed in your policy terms.

Remember, if you give us data about another person, in doing so you confirm that they have given you permission to provide it to us to be able to process their personal data as part of entering into this contract and also that you have told them who we are and what we will use their data for, as set out in this notice.

Who do we share your information with and why?

We may share your information with:

• Third parties involved in the administration of your claim:
  • Parts suppliers.
  • Sub-contracted repair technicians.
  • The product retailer, in instances where replacement furniture is necessary.
  • Other third parties specifically used for the administration of your claim.
• Our group companies from time to time for the purposes of administering your policy and any related claims.
• National anti-fraud databases, as part of our legal obligation to prevent fraud and money laundering.
• Auditors, regulators and ombudsmen, as required by legal obligation.
• Another organisation if we sell or buy (or negotiate to sell or buy) any business or assets.
• Another organisation in the event we transfer our agreement with you (of which you will be informed prior to transfer).

We will share your information if we are required to by law. We may share your information to enforcement authorities if they ask us to, or to a third party in the context of actual or threatened legal proceedings, provided we can do so without breaching data protection laws.

Some third parties that process your data on our behalf may do so outside of the European Union This transfer and processing is made on the basis of an adequacy decision by the European Commission under Article 45 of the UK GDPR.

Your Rights

There are a number of different requests you can make to Castelan in respect of your personal data. We will respond to you as quickly as possible and at least within one month of your request unless the number and complexity of the requests made is deemed sufficiently high in which case we may extend this time by a further two months. We will inform you if we need to make use of this additional time and why we need to do so.

We will not charge you for responding to any of these requests unless it can be demonstrated that you are making an excessive number of repetitive requests or that your request is not based on fact, realistic considerations, or the like. In this exceptional case, we may charge you a reasonable fee or choose to refuse your request. If you disagree then you may raise your concerns with the Information Commissioner's Office. https://ico.org.uk/concerns/

Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.

Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.

Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below). There are instances where we may choose to refuse such a request - this will be explained to you if appropriate.

Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes. There are instances where we may choose to refuse such a request - this will be explained to you if appropriate.

Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it. There are instances where we may choose to refuse such a request - this will be explained to you if appropriate.

Request the transfer of your personal information to another party.

Right to withdraw consent In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Compliance Manager. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

If you want to make any of the above requests, please use the contact details at the end of this document.

Rights related to automated decision making When you make an insurance claim online we may use automated decision making to decide on the best course of action and to check that the claim you have made is valid. We will only use the information you have given us and will give you information about the decision and how to contact us about the decision.

Changes to our Privacy Notice

We keep our Privacy Notice under regular review. This Privacy Notice was last updated on 14th June 2024

How to escalate data protection concerns

Raising a complaint with the regulator. The following are examples of when you might want to escalate an issue with us about your data to the Information Commissioner's Office (ICO):

• We do not take action on your request within one month of its receipt and do not provide you with a reason why. https://ico.org.uk/make-a-complaint/data-protection-complaints/data-protection-complaints/ 
• You believe the way we have processed your personal data is not in keeping with current Data Protection legislation https://ico.org.uk/make-a-complaint/data-protection-complaints/data-protection-complaints/
• You believe your rights under current Data Protection legislation have been infringed as a result of the way that we have processed your personal data and you have complained to the ICO then you may be able to make a claim for compensation via the small claims court. You should contact a solicitor for advice.