Overview
Claim Market Ltd Effective Date: May 2026 Version: 1.0
Purpose
The purpose of this Data Protection Policy is to ensure that Claim Market Ltd (“the Company”) processes personal data in a lawful, fair, and transparent manner in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy sets out the framework under which personal data is handled across the organisation and establishes clear principles, responsibilities, and safeguards to protect the rights and freedoms of individuals. It also reflects the Company’s commitment to maintaining high standards of data privacy, security, and accountability in all aspects of its operations.
Scope
This policy applies to all personal data processed by the Company, regardless of the format in which it is held, whether electronic or physical. It covers all systems, platforms, and processes used to collect, store, use, or share personal data, including those associated with websites, marketing campaigns, affiliate networks, and third-party integrations.
The policy applies to all employees, contractors, consultants, and any other individuals acting on behalf of the Company. All such individuals are required to comply with this policy when handling personal data as part of their role.
Definitions
For the purposes of this policy, personal data refers to any information relating to an identified or identifiable individual. This may include names, contact details, financial information, or any other data that can be used to identify a person directly or indirectly.
Processing refers to any operation performed on personal data, including its collection, storage, use, disclosure, or deletion. A data subject is the individual to whom the personal data relates.
Depending on the processing activity, Claim Market Ltd may act as a Data Controller or a Data Processor. Claim Market Ltd acts as a Controller where it determines the purposes and means of processing personal data, including in relation to its corporate website, business administration and certain acquisition activities. Claim Market Ltd may act as a Processor where it handles personal data strictly on the documented instructions of a partner organisation. The applicable contract, privacy information and processing arrangements will define the parties’ respective roles for each activity.
Data Protection Principles
The Company adheres to the core principles of data protection as set out under UK GDPR. Personal data is processed lawfully, fairly, and in a transparent manner, ensuring that individuals are informed about how their data is used. Data is collected only for specified, explicit, and legitimate purposes and is not further processed in a manner incompatible with those purposes.
The Company ensures that personal data collected is adequate, relevant, and limited to what is necessary for the intended purpose. Reasonable steps are taken to ensure that data is accurate and kept up to date, and any inaccuracies are corrected without delay. Personal data is retained only for as long as necessary, and appropriate measures are in place to ensure its secure disposal when no longer required.
Appropriate technical and organisational measures are implemented to protect personal data against unauthorised access, loss, or damage. The Company also maintains accountability for its data processing activities and is able to demonstrate compliance with these principles.
Lawful Basis for Processing
The Company processes personal data based on lawful grounds as required under UK GDPR. In many cases, processing is carried out on the basis of consent, where individuals have been clearly informed and have actively agreed to the use of their data. This is particularly relevant in the context of marketing communications and the sharing of data with third-party service providers.
In addition, the Company may rely on legitimate interests where processing is necessary for the operation and improvement of its business, provided that such interests do not override the rights and freedoms of individuals. For example, legitimate interests may include assessing enquiries, introducing individuals to appropriate service providers, and analysing business performance.
Processing may also take place where necessary to comply with legal obligations, such as responding to regulatory requirements or lawful requests from authorities. Where consent is relied upon, individuals have the right to withdraw that consent at any time.
Data Collection and Use
The Company collects personal data through a variety of channels, including website forms, landing pages, advertising campaigns, and affiliate marketing partners. Data may also be collected through direct interactions with individuals, such as telephone or email communications.
The personal data collected may be used to facilitate introductions to appropriate third-party providers in relation to agreed legal and claims-related services, to operate and assess marketing campaigns, and to support the Company’s legitimate business operations.
The Company ensures that all data collected is relevant and proportionate to the purposes for which it is processed and avoids collecting excessive or unnecessary information.
Data Sharing
The Company may share personal data with third-party service providers where necessary to fulfil the purposes outlined in this policy. This includes sharing data with solicitors and claims management companies who may be able to assist individuals with their enquiries.
In addition, personal data may be shared with service providers who support the Company’s operations, such as IT infrastructure providers, customer relationship management systems, and analytics platforms. These organisations act as data processors and are contractually bound to process data only in accordance with the Company’s instructions and applicable data protection laws.
Personal data may also be disclosed where required by law, including to regulatory authorities, law enforcement agencies, or legal advisors. The Company takes reasonable steps to ensure that all third parties with whom data is shared maintain appropriate data protection standards.
Data Retention
The Company retains personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal, regulatory, and operational requirements. In general, personal data is retained for a maximum period of six years.
This retention period reflects the need to maintain records for legal purposes, including the handling of complaints, the resolution of disputes, and compliance with applicable limitation periods. Where data is no longer required, it is securely deleted or anonymised in a manner that prevents identification of individuals.
Data Security
Claim Market Ltd maintains proportionate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures may include access controls, authentication controls, encryption where appropriate, secure system configuration, logging and monitoring, backup arrangements, supplier due diligence, incident-management procedures and staff awareness measures.
Access to personal data is restricted according to business need and the principle of least privilege. Security measures are reviewed periodically and updated where appropriate to reflect changes in technology, operations and risk.
Data Subject Rights
The Company recognises the rights of individuals under UK GDPR and is committed to facilitating the exercise of those rights. Individuals have the right to access their personal data and to receive information about how it is processed. They also have the right to request correction of inaccurate or incomplete data.
In certain circumstances, individuals may request the deletion of their data, the restriction of its processing, or object to its use where it is based on legitimate interests. They may also request to receive their data in a structured format where applicable.
Where processing is based on consent, individuals have the right to withdraw that consent at any time. The Company ensures that all such requests are handled promptly and in accordance with legal requirements.
Data Breach Management
The Company has procedures in place to identify, assess, and respond to personal data breaches. In the event of a breach, the Company will take immediate steps to contain and mitigate its impact.
Where required, the Company will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach. If the breach poses a high risk to individuals, those affected will also be informed without undue delay.
All breaches are documented, investigated, and reviewed to ensure that appropriate corrective actions are taken and to reduce the likelihood of recurrence.
International Data Transfers
Personal data may be transferred outside the United Kingdom. Where such transfers occur, the Company ensures that appropriate safeguards are in place to protect the data.
Where personal data is transferred outside the United Kingdom, Claim Market Ltd will ensure that a lawful transfer mechanism is in place. This may include relying on UK adequacy regulations or implementing appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures required by law.
Accountability and Governance
The Company is responsible for demonstrating compliance with data protection laws and maintaining appropriate governance structures. This includes keeping records of processing activities, conducting risk assessments where necessary, and regularly reviewing policies and procedures.
The Company ensures that appropriate oversight is in place for data protection matters and that responsibilities are clearly defined within the organisation.
Staff Responsibilities
All individuals working for or on behalf of the Company are responsible for handling personal data in accordance with this policy. They are expected to follow established procedures, maintain confidentiality, and report any concerns or incidents relating to data protection.
Failure to comply with this policy may result in disciplinary action and, where appropriate, legal consequences.
Policy Review
This Data Protection Policy is reviewed on a regular basis to ensure that it remains up to date and reflects current legal requirements, regulatory guidance, and business practices. Updates may be made periodically, and the latest version will always be available upon request.
Contact
For any questions relating to this policy or data protection matters, individuals may contact the Company using the following details:
Email: admin@claim.market