Business Continuity Policy

Overview

Claim Market Ltd Version 1.0 Effective Date: May 2026

Purpose

The purpose of this Business Continuity Policy (“Policy”) is to ensure that Claim Market Ltd (“the Company”) can continue to operate its critical business functions during and after a disruptive incident, while minimising operational, financial, legal, and reputational impact.

As a UK-based online lead generation business supplying leads to FCA-authorised claims management companies and related regulated firms, the Company recognises the importance of maintaining service availability, data integrity, regulatory compliance, and customer confidence.

Scope

This Policy applies to:

All employees, directors, contractors, and temporary staff;

All business systems, infrastructure, and processes operated by Claim Market Ltd;

All third-party suppliers and service providers supporting critical operations;

All locations from which the Company conducts business operations.

Objectives

The objectives of this Policy are to:

Protect the health and safety of personnel;

Maintain continuity of critical business services;

Protect customer and partner data;

Ensure compliance with applicable UK laws and regulations, including:

UK GDPR;

Data Protection Act 2018;

FCA requirements applicable to business partners and lead handling;

PECR (Privacy and Electronic Communications Regulations);

Minimise disruption to lead generation and delivery operations;

Restore critical systems and services within acceptable timeframes;

Preserve the Company’s reputation and contractual obligations.

Governance and Responsibility

1 Directors

The Directors are responsible for:

Approving this Policy;

Ensuring adequate resources for business continuity planning;

Reviewing business continuity arrangements annually;

Overseeing major incident response and recovery activities.

2 Business Continuity Coordinator

The appointed Business Continuity Coordinator is responsible for:

Maintaining the Business Continuity Plan (BCP);

Coordinating testing and reviews;

Managing incident communications;

Maintaining supplier and emergency contact lists.

3 Employees and Contractors

All personnel are responsible for:

Following continuity procedures;

Reporting incidents promptly;

Cooperating during disruption and recovery activities;

Maintaining awareness of continuity and security requirements.

Critical Business Activities

The following activities are considered critical to the Company’s operations:

Website and lead capture platform availability;

Lead validation and routing;

CRM and customer data management;

Communication systems (email, telephony, messaging);

Secure storage and processing of personal data;

Supplier and client communications;

Compliance monitoring and record keeping.

Business Continuity Risks

The Company recognises the following key risks:

Cyber attack or ransomware;

Website or hosting failure;

Internet or telecommunications outage;

Loss of key personnel;

Third-party supplier failure;

Cloud service disruption;

Data breach or corruption;

Power outage;

Fire, flood, or physical office disruption;

Pandemic or public health emergency.

Continuity Measures

To mitigate disruption, the Company maintains the following controls:

1 Technology and Infrastructure

Cloud-based hosting with redundancy where practicable;

Regular automated backups of critical systems and data;

Multi-factor authentication (MFA) for critical systems;

Endpoint protection and cybersecurity monitoring;

Secure remote working capability;

Access controls based on least privilege principles.

2 Data Protection

Encryption of sensitive personal data where appropriate;

Secure storage and restricted access controls;

Regular review of data retention practices;

Incident response procedures for data breaches.

3 Operational Resilience

Documented operational procedures;

Cross-training of staff for key operational functions;

Remote working arrangements;

Alternative communication methods;

Supplier due diligence and contingency planning.

4 Third-Party Suppliers

Critical suppliers are assessed periodically for resilience and reliability, particularly providers relating to:

Hosting and cloud infrastructure;

CRM systems;

Telecommunications;

Lead management systems;

Email and collaboration platforms.

Incident Response

In the event of a significant disruption:

The incident will be assessed and categorised;

Appropriate personnel will be notified;

Critical systems and services will be prioritised for recovery;

Stakeholders, clients, and suppliers will be informed where necessary;

Regulatory reporting obligations will be considered;

Recovery actions will be documented;

A post-incident review will be completed.

Recovery Objectives

The Company aims to restore critical operations according to the following targets:

These targets are reviewed periodically based on operational requirements.

Communications

During a disruption, communications will be coordinated by senior management.

Communication methods may include:

Email;

Telephone;

Messaging platforms;

Website notices;

Direct client communications.

Only authorised personnel may issue external statements regarding incidents.

Testing and Review

The Company will:

Review this Policy annually;

Test continuity arrangements periodically;

Update plans following significant operational or technological changes;

Conduct post-incident reviews after material disruptions.

Training and Awareness

Relevant staff will receive appropriate awareness training relating to:

Business continuity procedures;

Incident reporting;

Cybersecurity awareness;

Data protection obligations.

Policy Compliance

Failure to comply with this Policy may result in disciplinary action and could expose the Company to operational, legal, and reputational risk.

Recovery targets