Welcome to Card Protection

Privacy Policy

Introduction

This privacy notice will inform you as to how the Controllers (as defined in section 1 below) look after your personal data when you visit the website at https://quickreg.cppmembers.com/ (“Site”) (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you. 

1. Important information and who we are

Controllers

If you hold a United Kingdom Card Protection policy, Card Protection Plan Limited is the data controller and is responsible for your personal data (”CPP”).  CPP is a company registered in England and Wales under company number 1490503. CPP’s registered office is at 6 East Parade, Leeds, LS1 2AD. CPP is part of the CPPGroup Plc group of companies (“CPP Group”).

If you hold a Republic of Ireland Card Protection policy, Homecare Insurance Limited is the data controller and is responsible for your personal data (”Homecare”). Homecare is a company registered in England and Wales under company number 2793290. Homecare’s registered office is at 6 East Parade, Leeds, LS1 2AD. Homecare is also part of the CPP Group.

Your renewal pack which will have been sent to you will make clear whether you hold a United Kingdom or Republic of Ireland Card Protection Policy.

CPP and Homecare will collectively be referred to as the “Controllers”, “them” or “they” in this privacy notice.

Contact Details

You can contact CPP or Homecare (as applicable):

• by post at:
  • The UK Compliance Team, Card Protection Plan Ltd, PO Box 1419, Sunderland, SR5 9RN
  • The UK Compliance Team, Homecare Insurance Ltd, PO Box 1419, Sunderland, SR5 9RN; or
• by email at: DataPrivacy@cpp.co.uk

Purpose of this privacy notice

This privacy notice aims to give you information on how the Controllers collect and process your personal data through your use of this Site, including any data you may provide to them.

This Site is not intended for children and the Controllers do not knowingly collect data relating to children.

It is important that you read this privacy notice together with any other privacy notice or fair processing notice the Controllers may provide on specific occasions when they are collecting or processing personal data about you so that you are fully aware of how and why they are using your data. This privacy notice supplements the other notices and is not intended to override them.

Changes to the privacy notice and your duty to inform the Controllers of changes

The Controllers may change this privacy notice from time to time by updating this page. They will not necessarily bring changes or updates to your attention so please revisit this page periodically to re-read this privacy statement and to ensure you are aware of any changes when you visit the Site. If there are substantive changes, the Controllers may at their discretion bring those to your attention, for example, by a message posted on the landing page of the Site.

It is important that the personal data the Controllers hold about you is accurate and current. Please keep CPP or Homecare (as applicable) informed if your personal data changes during your relationship with them.

Third-party links

This Site may include links to third-party websites, which may include websites provided by other companies within the CPP Group. Clicking on those links may allow these third parties to collect or share data about you. The Controllers do not control these third-party websites and are not responsible for their privacy statements. When you leave the Site, you are encouraged to read the privacy notice of every website you visit.

2. The data the Controllers collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

The ways in which CPP or Homecare (as applicable) will use your data collected while you have a United Kingdom or Republic of Ireland Card Protection policy are outlined in the Privacy Notice contained within the relevant product terms & conditions which will have been sent to you- it is recommend that you read these carefully.

In addition, when using the Site, CPP or Homecare (as applicable) may collect and process the following data about you:

• Information you give CPP or Homecare (as applicable). This may include your name and contact information (including e-mail address and landline or mobile phone number), date of birth, home address, card numbers, sort code & account numbers (where relevant) and passport and driving license number.

• Information CPP or Homecare (as applicable) automatically collect about you.

This may include:

• technical information, including the Internet Protocol (IP) address used to connect your computer to the Internet, the type of device you are using to access the Site, resolution of the screen and operating system; and
• information about your visit such as whether you have visited the Site before and information collected through the use of Google Analytics which is anonymised.  The Controllers collect statistical information such as the number of visitors to certain areas of the Site during a given period. They collect this information for statistical review only and it cannot be used to identify an individual user.

If you fail to provide personal data

If you fail to provide personal information when requested on the Site, CPP or Homecare (as applicable) may not be able to action your request to register card details or valuable document details on your Card Protection policy via the Site. 

3. How is your personal data collected?

The Controllers use different methods to collect data from and about you including through:

• Direct interactions. You may submit personal data (such as your contact details and card numbers) to CPP or Homecare (as applicable) by filling in the form on the Site.
• Automated technologies or interactions. As you interact with the Site, CPP or Homecare (as applicable) may automatically collect technical data about your equipment, browsing actions and patterns as described in section 2 above. Google Analytics will collect information about your online activity on the Site, such as the web pages you visit and the links you click.  For more information on the Site’s use of Google Analytics, please see the Cookie Policy by clicking the link at the bottom of the Site.

4. Purposes for which your personal data will be used

Set out below, in a table format, is a description of all the ways CPP or Homecare (as applicable) plan to use your personal data, and which of the legal bases they rely on to do so. The table also identifies CPP’s or Homecare’s legitimate interests where appropriate.

Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this Site may become inaccessible or not function properly. For more information about the cookies used on this Site, please see the Cookie Policy by clicking the link at the bottom of the Site. 

5. Disclosures of your personal data

The Controllers may have to share your personal data with the parties set out below for the purposes set out in the table in paragraph 4 above:

Service Providers

Your personal information will be made available to CPP’s and Homecare’s (as applicable) authorised service providers (which will include other companies within the CPP Group which provide services to CPP and Homecare) and third party suppliers which perform certain services on CPP’s or Homecare’s behalf e.g. providing certain benefits under your Card Protection policy, providing IT support and maintenance, providing hosting services, providing online payment services and providing marketing services.

These service providers may have access to personal information needed to perform their functions on CPP’s or Homecare’s behalf but are not permitted to share or to use such information for any other purpose.  CPP and Homecare require all third parties to respect the security of your personal information and to treat it in accordance with the law.

When you use the features of your Card Protection

If you report a lost card to CPP or Homecare (as applicable), your name, address, date of birth, telephone number, bank account number, sort code (where relevant) and the card number (unless CPP or Homecare (as applicable) notifies the card issuer of the loss via telephone) will be passed to the card issuer so that they can cancel it and provide a replacement.

If you make a claim under the policy, CPP or Homecare (as applicable) may share your information with the police, other insurers and fraud prevention agencies to prevent fraudulent claims.

Other companies within the CPP Group

CPP or Homecare (as applicable) may share limited personal information with other companies within the CPP Group e.g. to the extent needed for proper management and parental analysis and decision making.

Other Organisations

CPP and Homecare may also disclose your personal information:

• In response to a court order, or a request for cooperation from a law enforcement or other government agency;

•  To establish or exercise their legal rights; to defend legal claims; or as otherwise required or permitted by applicable laws and/or regulations;

•  When they believe that disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding illegal activity, suspected fraud, or other wrongdoing; to protect and defend the rights, property or safety of them, other CPP Group members, customers, staff, suppliers or others; to comply with applicable law or cooperate with law enforcement; or to enforce their terms or other agreements;

•  To prospective or actual buyers in the event that they sell any of their business or assets, or to other CPP Group members in the event of a reorganisation.

If you hold a United Kingdom Card Protection product, CPP may also share your personal data with the following parties:

The Insurer

CPP will send limited information to Chubb European Group SE (the Insurer), who underwrite the Card Protection policy. The information provided to the Insurer by CPP is generally limited to non-personal information such as the number of policies sold by CPP to be underwritten by the Insurer.

In the event that CPP is no longer able to administer the policy, CPP will pass personal information including your name and financial information to the Insurer in order for the Insurer to continue to administer the policy. In this case, the Insurer would use the information supplied to them for underwriting, policy administration, claims management and other insurance purposes, as further described in their Data Protection Statement in the Card Protection terms and conditions.

CPP may also pass your personal information to the Insurer in order for the Insurer to comply with its audit requirements in respect of the policies which it underwrites.

Third party companies who provide aspects of the Card Protection product (applicable if your Card Protection policy includes the Protective Registration feature)

Cifas

If you report the loss of important documents, such as your passport or driving licence, if you consent, your personal information will be used to create a Protective Registration record about you within the Cifas National Fraud Database, which will then be made available to the members of Cifas and to fraud prevention agencies participating in Cifas. The Protective Registration record will be used to help prevent fraud and money-laundering and to verify your identity. There may be a slight delay when you apply for financial products and services as extra checks are made. Where the risk of fraud is very low some companies may instead accept the application and then contact you separately to ensure the application is from you. Further details of how your information will be used by Cifas when using this aspect of the policy, and your data protection rights, can be found by contacting CPP on the contact details set out in paragraph 1 of this Privacy Notice.

6. International transfers

The GDPR permits the export of personal data to other countries subject to the provision of adequate levels of protection for the processing of such personal data. CPP or Homecare (as applicable) will ensure that if they transfer your personal information outside the EEA, adequate safeguards are put in place to protect your personal information as data protection standards in those countries may differ from those in the EEA.

Please contact CPP or Homecare’s (as applicable) Data Protection Officer on the contact details set out in section 1 of this Privacy Notice if you want further information on the specific mechanism used by CPP or Homecare (as applicable) when transferring your personal data out of the EEA.

7. Data security

The Controllers have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, access to your personal data is limited to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on CPP or Homecare’s (as applicable) instructions and they are subject to a duty of confidentiality.

The Controllers have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where they are legally required to do so.

8. Data retention

How long will CPP or Homecare (as applicable) use my personal data for?

The Controllers will retain your personal information for the period necessary to fulfil the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by law.  Please note that by law the Controllers have to keep basic information about their customers (including contact details, financial information and details relating to policies) for at least six years after they cease being a customer for tax and legal purposes.

9. Your legal rights

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information CPP or Homecare (as applicable) hold about you and to check that they are lawfully processing it.
• Request correction of the personal information that CPP or Homecare (as applicable) hold about you. This enables you to have any incomplete or inaccurate information they hold about you corrected.  If you think any information they have about you is incorrect or incomplete, please contact CPP or Homecare (as applicable) as soon as you can using the contact details set out below. CPP or Homecare (as applicable) will correct or update any information as soon as possible.
• Request erasure of your personal information. This enables you to ask CPP or Homecare (as applicable) to delete or remove personal information where there is no good reason for them continuing to process it. You also have the right to ask them to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where they may have processed your information unlawfully or where they are required to erase your personal information to comply with local law. Note, however, that CPP or Homecare (as applicable) may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal information where CPP or Homecare (as applicable) are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your personal information. This enables you to ask CPP or Homecare (as applicable) to suspend the processing of personal information about you, for example if you want them to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal data, object to the processing of your personal data, or request that CPP or Homecare (as applicable) transfer a copy of your personal information to another party, you can contact:

• CPP by post at: Data Protection Officer Card Protection Plan Limited, PO Box 1419, Sunderland, SR5 9RN
• Homecare by post at: Data Protection, Homecare Insurance Limited, PO Box 1419, Sunderland, SR5 9RN
• CPP or Homecare (as applicable) by email at: DataPrivacy@cpp.co.uk

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, CPP or Homecare (as applicable) may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, CPP or Homecare (as applicable) may refuse to comply with the request in such circumstances.

CPP or Homecare (as applicable) may need to request specific information from you to help confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

CPP or Homecare (as applicable) will try to respond to all legitimate requests within one month. Occasionally it may take them longer than a month if your request is particularly complex or you have made a number of requests. In this case, CPP or Homecare (as applicable) will notify you and keep you updated.

You also have the right to make a complaint at any time to the Information Commissioner's Office (“ICO”), the UK supervisory authority for data protection issues (www.ico.org.uk).  CPP or Homecare (as applicable) would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact CPP or Homecare (as applicable) in the first instance.