Privacy Notice | Covertime

Covertime Limited ("Covertime", "the Company", “our”, “us”, “we”, “Data Controller”) is committed to protecting the privacy and security of customer data. This privacy notice outlines how Covertime collects, processes, stores, and protects customer personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and other applicable laws within the United Kingdom. 

Covertime Limited is registered with the Information Commissioner's Office with registration reference number ZB739185.

This policy applies to all personal data processed by Covertime and all employees, contractors, and third parties acting on behalf of Covertime, where applicable. 

When you first visit our website and download our app, we'll ask you to agree to our privacy notice and use of cookies (website only) in accordance with the terms of this privacy notice.

You can find our Cookie Policy here.

We amend this privacy notice from time to time, so please review it regularly, for the most up-to-date version.

If you have any questions about this Data Protection Policy or wish to exercise any of your data subject rights, please contact our Data Protection Officer: 

Post: Covertime Limited, Third Floor, 21 Perrymount Road, Haywards Heath, West Sussex, RH16 3TP

Email: [email protected] 

Covertime is a Data Controller. We exercise overall control of the personal data being processed and are ultimately in charge of and responsible for the processing of your data. 

We collect or use the following information to provide our products and services to you:

• Name
• Contact details (email and mobile number)
• Address
• Date of birth
• Vehicle information including vehicle registration number
• Payment details 
• Credit reference information
• Driving Licence entitlement and driving history
• Vehicle MOT and VED status
• Website user information (including user journeys and cookie tracking)
• Identification documents
• Information relating to claims or complaints
• Chat / email transcripts (where applicable)
• Call recordings (where applicable) 

In addition, we collect information sourced from third-party companies such as credit reference and fraud prevention agencies and databases. This may include driving licence checks for verification of entitlement, as well as other relevant information necessary for the purpose of providing an insurance quotation.  When LexisNexis perform their identity check, it creates a soft footprint on your credit report. This footprint is not visible to lenders and does not affect your credit score.

We use the following personal information to pre-fill a new quote for you if you have bought a policy from us before:

• Name
• Contact details (email and mobile number)
• Address
• Date of birth
• Vehicle information including vehicle registration number
• Driving licence details
• Details of your previous cover (for example, the duration)

This information comes from your most recent policy with us. We may use it when we contact you about your policy expiring, or when you return to our website or app. You can change any of these details before you buy, or start a new quote instead.

Getting a quote through an AI assistant

You may be able to get an indicative price from us through an AI assistant, for example through the Covertime app in ChatGPT, or through another AI assistant that uses the quote tools on our website.

We collect and use the following personal information to give you an indicative price when you ask through an AI assistant:

• Vehicle registration number
• Date of birth
• Postcode
• Length of cover you want
• Occupation and how long you have held your licence (if you provide them)
• Email address (if you provide it, only to pre-fill your details on our website, and never for marketing)
• Your IP address, if you use an AI assistant through our website. If you use ChatGPT, OpenAI does not share your IP address with us; instead we may receive a coded identifier from OpenAI that does not include your name
• Vehicle details we get from our vehicle data provider using your registration number

How we use your information:

• The AI assistant is provided by a separate company. The information you give it, and your conversation with it, are handled by that company under its own terms and privacy policy, not ours. We do not control how that company uses your information, so please read its privacy policy before using it. Some AI providers, including OpenAI (which provides ChatGPT), are based outside the United Kingdom.
• How we use it. We use these details only to calculate an indicative price range and to send you to our website if you want to continue. We keep the details the AI assistant sent us for up to 7 days, so that your details are already filled in if you continue to our website, and then we delete them. If you continue to a full quote, the rest of this privacy notice applies in the usual way.
• Checks we carry out. To calculate the price, we check your vehicle registration with our vehicle data provider (UK Vehicle Data) to identify the vehicle. We do not carry out driving licence or identity checks until you continue to our website.
• Security records. We keep limited technical records of requests made through AI assistants to keep our services secure and to prevent fraud and misuse. We remove or mask information that could identify you where possible, and delete these records after 30 days.

• Name
• Contact details (email and mobile number)
• Vehicle information including vehicle registration number
• Criminal offence data (including Disclosure Barring Service (DBS), Access NI or Disclosure Scotland Checks)
• Call recordings (where applicable)
• Financial transaction information
• IP addresses
• Claims experience

• Name
• Contact details (email and mobile number)
• Address
• Vehicle information including vehicle registration number
• Marketing preferences
• Location data
• Purchase or viewing history
• IP addresses
• Website user information (including user journeys and cookie tracking)
• Records of consent, where appropriate
• Assessing the effectiveness of marketing messages

• Name
• Contact details (email and mobile number)
• Vehicle information including vehicle registration number
• Identification documents
• Financial transaction information

• Name
• Contact details (email and mobile number)
• Address
• Vehicle information including vehicle registration number
• Payment details
• Purchase history
• Customer or client accounts and records
• Financial transaction information
• Chat / email transcripts (where applicable)
• Call recordings (where applicable)

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. If that is the case, this will be explained to you. 

• Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. 

• Your right to erasure - You have the right to ask us to delete your personal information. 

• Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. 

• Your right to object to processing - You have the right to object to the processing of your personal data. Covertime does not use profiling or automated decision-making that could have legal or significant effects on individuals. 

• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. 

• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. 

If you make a request, we will respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this Privacy Notice. We may ask you to provide further information in order that we can locate your data and action your request. In some cases, we may ask you to provide proof of identification. This will be handled in line with this Privacy Notice.

We use different tools for automated decision-making. This enables us to apply our pricing and acceptance rules quickly and consistently. This determines whether we can provide a quotation and, if so, with which insurer and at what price. The same pricing and acceptance rules are used when we give an indicative price through an AI assistant.

You have a right to opt out of automated decision-making. However, some of the automation we use for decision-making is needed in order that we may provide you an accurate quotation. Objecting to the use of these tools may result in us being unable to provide a quotation. To exercise your rights to object, please contact us on the details at the top of this Privacy Notice. 

Our lawful bases for collecting or using personal information to provide services and goods are:

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you and contact you about an existing insurance policy. All of your data protection rights may apply except the right to object.

• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

• Legitimate interest – where you have bought a policy from us before, we use the details from that policy to pre-fill a new quote for you (see above). We also keep limited security records of requests made through AI assistants to protect our services and prevent fraud and misuse (see "Getting a quote through an AI assistant"). All of your data protection rights may apply, except the right to data portability. You have the right to object to this use of your information.

When you ask for an indicative price through an AI assistant, we use your details because you have asked us to provide a price before you decide whether to buy (Contract).

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

• Legitimate interest – where we believe there is a positive benefit for you by way of cost savings, we will communicate such adverts with you under the grounds of legitimate interest. These adverts may be shared with you in transactional communications and will always be optional. This is separate to marketing communications which are consent-only and driven by your preferences.

• Contract – we will use the information you have provided to contact you about your insurance policy, including when it starts (Policy Confirmation) and when it ends (Policy Expiration).

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

• Directly from you
• AI assistants you choose to use to request a price from us
• Debt collection agencies
• Insurance companies
• Publicly available sources
• Credit reference and fraud prevention agencies and databases 
• Suppliers and service providers

If when accessing our products or services you chose to share personal information about another individual, it is your responsibility to ensure that you have sought permission from the individual concerned, that their details are correct and that they have read and understood the terms and conditions of cover.

Covertime will retain customer data only for as long as necessary to fulfil the purposes for which it was collected, and to meet legal and contractual obligations.

In exceptional circumstances we may retain data for a longer period where the data is required for the resolution of a dispute, claim or legal proceedings.

We share personal information with:

• Insurance companies
• Third party claims management companies
• Financial or fraud investigation authorities
• Credit reference agencies and databases
• Relevant regulatory authorities
• Digital review platforms
• Organisations we may be under legal or regulatory obligations to share your personal data with including courts, regulators, law enforcement or in certain cases other insurers
• If we were to sell part of our business we would need to transfer your personal data to the purchaser of such business.

We use third party data processors to enable us to provide our services to you. These parties may receive and/or store personal customer data. When entering agreements with these third parties, it is stipulated that personal data will not be processed for any purpose other than as stated in our respective privacy policies.

Whether we share your information with these third parties may depend on your Cookies consent and whether you chose to accept or decline additional Cookies.

Covertime may contact you via email to invite you to review any services and/or products you received from us in order to collect your feedback and improve our services and products (the “Purpose”). We use an external company, Trustpilot A/S (“Trustpilot”), to collect your feedback which means that we will share your name, email address and reference number with Trustpilot for the Purpose.

If you want to read more about how Trustpilot process your data, you can find their Privacy Policy here. You can unsubscribe from receiving emails from Trustpilot using the link within the email.

Covertime may also use such reviews in other promotional material and media for our advertising and promotional purposes to help other customer’smake informed decisions about our products and services.

We may share or match anonymous data such as your email address, for targeting purposes for use by Google Ads and Meta. This is to help ensure that our ads are targeted at relevant audiences.

For ease of use, we store an authentication token on your device to keep you logged in. This is not used for any other purpose or shared with any third party. The token is persistent, until you log out of the app, at which point the token is removed.

As an app user you can permanently delete your Covertime account from within the app. We recommend you only do this once any active policies have ended. If you have any active policies when you delete your account, the cover will remain in force, but you will be unable to service your insurance needs through the app, and you’ll no longer be able to view any previous policies. Deletion is permanent and cannot be undone. To delete your account, follow the instructions in the app or contact us using the contact details at the top of this privacy notice.

The data processing and storage facilities of some of our Third-Party Data Processors may belocated outside the United Kingdom. When this is the case, we used approved standard data protection clauses approved by the European Commission (for example, Standard Contractual Clauses)to help ensure that your data is protected to the standard we would accept. By sharing your data, you agree to this transfer, storage and processing.

Covertime uses Microsoft access control systems to apply cybersecurity principles, ensuring that data is protected against unauthorised access, loss, or disclosure. Key measures include authentication and authorisation, encryption, access controls and regular audit of our data protection measures to ensure they remain effective. 

Sending data over the internet is not completely secure. Covertimewill do its best to protect your data, but we cannot guarantee its security, and sharing data with us is done at your own risk.

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, or you believe we have not complied with your data protection rights, you can also complain to the ICO using the following details:

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113

Website: Find the Information Commissioner's Office website here.