About Us
John Patons (Insurance Services) Limited, trading as Patons Insurance, Patons, TaxiCover, Cabshield, Sureplan Insurance and Sureplan Insurance Brokers (referred to as ‘we’, ‘us’ or ‘our’), is a company registered in Scotland (Company no. 101060). Our registered address is 40 Charles Street, Glasgow, G21 2PB.
The Purpose of this Policy
This Policy is designed to help you understand what kind of information we collect in connection with our products and services and how we process and use this information. In the course of providing you with products and services we will collect and process information that is commonly known as personal data.
This Policy describes how we collect, use, share, retain and safeguard personal data.
This Policy sets out your individual rights. These rights include your right to know what data is held about you, how this data is processed and how you can place restrictions on the use of your data.
We will process your personal data in line with:
• The UK’s updated Data Protection Act 2018.
• The UK General Data Protection Regulation (UK GDPR)
• The Data (Use and Access) Act 2025 (DUAA).
• The privacy and Electronic Communications Regulations 2003 (PECR), together with any subsequent amendments
• Guidance issued by the Information Commissioner’s Office (ICO)
For the purposes of meeting the territorial scope requirements of UK data protection legislation, the United Kingdom is identified as the named territory where the control and processing of personal data referred to under this Privacy Policy takes place.
We also may transfer into the European Economic Area (EEA) under adequacy arrangements which exist between the EEA and the UK, and which ensure equivalent standards of protection are maintained.
Where we transfer personal data outside of the UK or EEA, details of the safeguards applied are set out in the section headed ‘International Transfers of Personal Data’.
What is Personal Data?
Personal data is information relating to an identified or identifiable natural person. Examples include an individual’s name, age, address, date of birth, gender and contact details.
Personal data may contain information which is known as special category personal data. This may include information relating to an individual’s health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, sexual life or sexual orientation.
Personal data may also contain data relating to criminal convictions and offences.
For the purposes of safeguarding and processing criminal conviction and offence data responsibly, this data is treated in the same manner as special category personal data, where we are legally required to comply with specific data processing requirements.
Personal data we collect
In order for us to arrange and administer insurance for you we will collect and process personal data about you. We will also collect your personal data where you request information about our services, customer events, promotions and campaigns.
We may also need to collect personal data relating to other individuals in order to arrange and administer insurance. In most circumstances, you will provide us with this information. Where you disclose personal data of others, you must ensure you are entitled to do so.
You may provide us with personal data when completing online quote or contact forms, when contacting us via the telephone, by email, by post or where we provide paper-based forms for completion.
As a provider of insurance services, we process the following categories of personal data:
• Personal data such as name, address, date of birth, gender, contact details and claims history
• Special category personal data such as health information and details relating to injury claims
• Data relating to criminal convictions and offences such as driving convictions and insurance fraud information
We may record communications with us when contacting our customer service, complaints or other customers-focused departments.
We collect personal data when you visit our website, including your IP address and other electronic identifiers.
We also use cookies ad similar technologies to improve accessibility, monitor website performance and understand visitor behaviours. Further details are available in our www.patonsinsurance.co.uk/cookie-policy/
Where applicable, we may collect personal data through telematics or similar location-tracking services where you have agreed to the use of such services.
How We Share Your Data
Where we collect data directly from you, we are the Data Controller of that information.
Where we use third parties to process personal data on our behalf, those parties act as Data Processors.
Other parties involved in underwriting or administering y our insurance, including insurers, premium finance providers and other intermediaries, may also process your personal data as Data Controllers. In some circumstances we may operate as Joint Controllers in relation to your personal data.
A Data Controller is the individual or organisation which determines the purposes and means of processing personal data.
A Data Processor is the individual or organisation which processes personal data on behalf of a Data Controller.
We share personal data within our business and with trusted business partners where necessary to place, underwrite, administer and manage insurance policies and claims.
We may also share personal data with authorised third parties, including:
• Insurers
• Underwriters
• Premium finance providers
• Credit reference agencies
• Claims handling companies
• Loss adjusters
• Insurance brokers
• Reinsurers
• Regulators
• Consumer review platforms, including Feefo
• Debt companies
• Data analysis companies
• Contracted third parties providing services in connection to your policy
If you require further information regarding how we use and share personal data, please contact our Data Privacy Representative at [email protected]
Why Do We Need Your Personal Data?
We use personal data to:
• Quote for an arrange insurance products and services
• Administer policies
• Process claims and renewals
• Manage your account
• Respond to enquiries
• Handle complaints
• Administer our business
We process special category personal data and criminal conviction data where necessary for the performance of our contract with your and for reasons of substantial public interest in connection with the provision of insurance services.
We may also use aggregated and anonymised data for statistical analysis, business planning, product development and service improvement.
When you purchase our products or services, you are entering into a contract with us. Where you request information or quotations, we rely upon our legitimate business interests to provide information regarding our products and services.
In some circumstances we may ask for you consent to:
• Market products and services to you
• Share you information with selected business partners
• Carry out profiling activities
• Collect additional information to provide tailored support
• Transfer personal data outside the UK or EEA where required
Where consent is required, you may withdraw it at any time by contacting us.
How Long We Keep Your Data
At the end of a contractual relationship, we will review the need to continue retaining personal data after 7 years.
We will review the need to continue retaining special category and criminal conviction data after 7 years.
Where you have submitted a claim, we will retain your data for a period of 7 years.
Where you have requested a quotation, we will retain your personal data for 3 years.
Where you have requested information regarding our products or services, we will retain your personal data for 3 years
Where you make a complaint, we will review the need to retain the information after 7 years.
Where law enforcement authorities or regulatory bodies notify us of an active investigation or potential prosecution, we will retain information for as long as legally required.
We may retain personal data for longer where necessary to defend legal proceedings, pursue claims, satisfy legal obligations or where future claims may reasonably be anticipated.
Automated Decisions and Profiling
We sometimes use Artificial Intelligence (AI) technologies and automated systems to enhance our services and decision-making processes. These systems help us provide efficient, consistent and cost-effective services and are regularly reviewed for fairness, accuracy and bias.
Personal data collected when you apply for insurance or premium finance may be processed using systems that make automated decisions without direct human involvement. These decisions assist with assessing applications, generating quotations, administering policies and determining eligibility for products and services.
We may also use automated processing to identify products or services that may be of interest to you. This is commonly referred to as profiling and will only be undertaken where permitted by law and, where required, with your consent.
You have the right to object to solely automated decision-making, including profiling, where it produces legal or similarly significant effects concerning you. This right does not apply where such processing is necessary for entering into or performing a contract or were authorised by law, including fraud prevention and credit assessment activities.
Where you believe an automated decision has been made using inaccurate information, or where you wish to provide further information, we will arrange for the decision to be reviewed by an appropriately authorised individual. While we cannot guarantee that the outcome will change, we will ensure a meaningful human review is taken.
International Transfers of Personal Data
We may transfer your personal data to third parties located outside the United Kingdom and European Economic Area here necessary for underwriting, claims handling policy administration or other legitimate business purposes.
Some countries benefit from adequacy arrangements recognised by the UK as providing equivalent levels of protection for personal data. Where this is not the case, we implement appropriate safeguards, including contractual protections and recognised international data transfer mechanisms.
Any third party receiving personal data is permitted to use that information only for the agreed purpose and must implement appropriate technical and organisational security measures. Third parties are prohibited from sharing personal information with others unless authorised by us or required by law.
Your Rights
Individuals are provided with legal rights governing the use of their personal data. These rights include:
• The right to be informed
• The right of access
• The right to object
• The right to restrict processing
• The right to rectification
• The right to erasure
• The right to data portability
• The right to object to certain automated decision-making (including profiling) and to contest automated decisions that have been made
We will not normally charge a fee for handling requests relating to your rights. However, where requests are manifestly unfounded, excessive or repetitive, we may charge a reasonable administration fee.
Where you object to the collection, use or sharing of your personal data, we may be unable to provide our products and services.
In certain circumstances, legal obligations, substantial public interest or vital interests may take precedence over your request.
The flow of data within the insurance sector can be complex and there may be occasions where we depend upon other organisations to help satisfy your request. This may affect response times.
To exercise your rights, please contact our Data Privacy Representative using the details below:
Although not one of the formal data subject rights under the Data Protection Act 2018 or UK GDPR, the Data (Use and Access) Act 225 gives individual the right to make a data protection complaint.
We maintain a register of all data protection complaints and handle them in accordance with applicable legal requirements.
Protecting Your Data
We take appropriate technical and organisational measures to protect the confidentiality, integrity, availability and security of personal data, including when sharing information within our business or with authorised third parties.
Data Privacy Representative
To ensure data privacy and protection remains a key focus within our organisation, we have appointed a Data Privacy Representative who reports to senior management.
Ian Hayes
Email: [email protected]
Telephone: 0151 538 1313
Complaints
If you are dissatisfied with any aspect of how we process your personal data, please contact our Data Privacy Representative.
If you make a data protection complaint, we will deal with it in accordance with the requirements of the Data (Use and Access) Act 2025. We will:
• Acknowledge receipt of your complaint within 30 days
• Take appropriate steps to investigate and respond without undue delay
• Keep you informed of progress where appropriate
• Notify you of the outcome without undue delay
You also have the right to complain to the Information Commissioner’s Office (ICO)
Website: https://ico.org.uk/concerns/
Live Chat: https://ico.org.uk/global/contact-us/live-chat
Helpline 0303 123 1113
How to Contact Us
If you have any questions regarding this Privacy Policy, the use or retention of your personal data, your individual rights, or wish to exercise any of your rights, including your rights relating to automated decision-making and profiling, please contact:
Ian Hayes
Data Privacy Representative
Address:
Patons Insurance
Unit 9, Connect Business Village
24 Derby Road
Liverpool
Merseyside
L59PR
Email: [email protected]
Telephone: 0151 538 1313
To opt out of marketing communications, please email: