Privacy Policy

1. Information We Collect

We may collect the following categories of personal data:

• Identity data: name, date of birth
• Contact data: email address, phone number, postal address
• University data: institution name, student ID (where required for verification)
• Policy data: coverage selected, policy start/end dates, payment information (processed via our secure payment provider — we do not store card details)
• Claims data: information you provide when making a claim, including supporting documents
• Technical data: IP address, browser type, device information, pages visited, time on site (via cookies and analytics)
• Marketing preferences: your consent choices for marketing communications

2. How We Use Your Data

We use your personal data for the following purposes, under the following legal bases:

Purpose	Legal Basis
Providing insurance quotes and policies	Contract performance
Processing and managing claims	Contract performance
Communicating about your policy	Contract performance
Fraud prevention and detection	Legitimate interests / legal obligation
Regulatory compliance (FCA requirements)	Legal obligation
Improving our website and services	Legitimate interests
Sending marketing emails (with your consent)	Consent
Analytics and website performance	Legitimate interests (with cookie consent)

3. How We Share Your Data

We may share your data with:

• Insurance underwriters — to assess risk and process your policy
• Claims handlers — to assess and settle claims on our behalf
• Payment processors — to process premium payments securely
• IT service providers — who host or support our systems (under data processing agreements)
• Regulators — including the FCA and ICO when required by law
• Fraud prevention agencies — to detect and prevent fraudulent activity

We do not sell your personal data to third parties. We do not share your data for third-party marketing purposes without your explicit consent.

4. International Data Transfers

Where we transfer data outside the UK, we ensure appropriate safeguards are in place, such as UK adequacy decisions, standard contractual clauses, or other approved transfer mechanisms.

5. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, and as required by law. Key retention periods:

• Policy records: 7 years from policy end date (regulatory requirement)
• Claims records: 7 years from claim settlement
• Website enquiries: 2 years from last contact
• Marketing preferences: until consent is withdrawn

6. Your Rights

Under UK GDPR, you have the following rights:

• Right of access — to request a copy of your personal data
• Right to rectification — to correct inaccurate data
• Right to erasure — to request deletion (subject to legal retention requirements)
• Right to restrict processing — in certain circumstances
• Right to data portability — to receive your data in a machine-readable format
• Right to object — to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — at any time, without affecting prior processing

To exercise any of these rights, contact us at privacy@studentprotection.co.uk. We will respond within one month.

7. Cookies

We use cookies to improve your browsing experience and analyse website performance. Cookies we use include:

• Essential cookies — required for the website to function (no consent needed)
• Analytics cookies — to understand how visitors use our site (Google Analytics, with anonymised IP)
• Marketing cookies — only with your explicit consent

You can manage cookie preferences via our cookie banner or through your browser settings.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. All data is transmitted over encrypted connections (HTTPS). Payment data is handled by PCI-DSS compliant payment processors and is never stored on our own servers.

9. Children's Data

Our services are intended for students aged 18 and over. We do not knowingly collect personal data from individuals under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email to policyholders and by a notice on this page. The date at the top of this policy reflects when it was last updated.

11. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk | 0303 123 1113.

We would, however, appreciate the opportunity to address your concerns directly before you contact the ICO. Please email us at privacy@studentprotection.co.uk.