Privacy Policy

Privacy Policy

1. Who are We?

Commercial and General Limited (hereinafter “We”, “Us” or “Our”) is the data controller in relation to the processing of the personal information that you provide to Us when you use Our Services. We operate in the United Kingdom and We all take your privacy very seriously.

Our registered office address is located at Marvan Court, 1 Waldegrave Road, Teddington, TW11 8LZ and You can find Us on the UK Companies House website under Company Reference Number 03994456. We are also authorised and regulated by the UK Financial Conduct Authority. You can find our details on the Financial Services Register under the Financial Register Number 300001.

If you have any queries relating to Our use of your personal information, or any other related data protection questions, please contact Our Customer Services Team by email at [email protected] or by telephone on +44 (0)20 3582 1172; lines are open 08:00 to 20:00 on Monday to Friday and 09:00 to 18:00 Saturday and Sunday.

This Privacy Policy explains how We will use personal information about you and the steps We take to ensure your personal information is kept secure and confidential in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

 The Privacy Policy should be read together with Our Terms of Business.

​2. How do We collect personal information?

We may obtain personal information from you through the websites, mobile applications or other similar devices, channels or applications operated by or on Our behalf including this one (referred to collectively in this Privacy Policy as the “Sites”): 

In some circumstances, one or more of other Our group companies may be used to perform specific data processing functions on Our behalf, but this will not provide any group companies with authorisation to use your data outside of these specific functions. 

3. What personal information do We collect? 

We collect personal information that you give to Us when using Our Services via any of the Sites, for example, We may collect your name, address, date of birth, email address or telephone number as well as some details relevant to the products you are enquiring about. This might be, for example, to obtain an insurance quote, to buy a product, or enter a competition.

When providing Our Services to you, We may also store information about how you use Our Sites, for example, the pages viewed, the website from which you came to visit Our Sites, changes you make to information you supply to Us, details of the quotes you request and your transactions, together with details of your financial information, for example, bank account or payment details. We make sure that We have appropriate security measures to protect your information (see section 11 below “How secure is Our site and what steps do We take to keep you safe?”). We will periodically review your personal information to ensure that We do not keep it for longer than is permitted by law (see section 14 below which details how long We keep your personal information for).

It is your responsibility to check and ensure that all information and data you provide on Our Sites is correct, complete, accurate and not misleading and that you disclose all relevant facts.

When providing Our Services to you We do not need to collect or process personal information which data protection legislation defines as sensitive personal information, such as medical history or criminal convictions.

We do not knowingly collect or store any personal information about children under the age of 13 (the UK GDPR age of consent). If you are aged 13–15, please get your parent or guardian’s permission please get your parent or guardian’s permission before you provide any personal information to Us.

If you are providing Us with another person’s information you should first ask them to read this Privacy Policy and Our Terms of Business. By giving Us information about another person you are confirming that they have given you consent to provide the information to Us and that they understand how their details will be used.

To ensure the Services We provide continue to meet your needs, We may ask you for feedback on your experience of using Our Sites. Any feedback you provide will only be used as part of Our programme of continuous improvement and will not be published on Our Sites.

We may also use your personal data to send you an invitation to provide a public review of Our service on a third-party website. If you choose to respond to this invitation, you will be asked to submit your review directly to the third-party review site and your use of that site will be subject to their own terms of business and privacy policy.

4. How do We use your personal information? 

We may use your personal information:

• ​To enable you to access and use the Services;
• To personalise and improve aspects of Our Services;
• For research, such as analysing market trends, and customer demographics;
• To communicate with you, including some or all of the following:
  • Sending you information about products and services which We think may be of interest to you – If you agree, We will contact you (depending on your contact preferences) via email, post, telephone, SMS, or by other electronic means such as via social and digital media. This may include new product launches, newsletters, promotions, competitions, and opportunities to participate in market research;
  • Sending you annual renewal quotes based on information you previously provided to Us (if you have requested quotes) – when Our systems indicate that your renewal is due (either when a policy you bought from Us is due to expire, or based on the dates you entered for your most recent quote) We may resubmit your quote details to give you an idea of what your quotes could be for your next renewal;
  • Sending you a confirmation email of your quote – when you obtain a quote with Us, you may automatically be sent confirmation of your quote by email or SMS so that you have a record of it and can easily retrieve your quote in the future. This is a standard part of Our Services and by using the Services you agree to receive these communications;
• To process a transaction between you and a third party, such as an Insurer;
• To track sales, which may involve Us sharing data with your Insurer relating to the product(s) you have bought. Your Insurer may also send Us information they hold relating to the product(s) you have bought for this purpose;
• To match Our data with data from other sources. We may validate and analyse your information and, in some cases, match it against information that has been collected by a third party to ensure that the information We hold about you is as accurate, as possible. As well as ensuring that any marketing material that We send you is appropriate to your needs;
• To enable you to share Our content with others, e.g. by using any ‘Recommend a friend’ or ‘Social Sharing’ functionality on Our Sites. 

We will store the personal information you provide and may use it to pre-populate fields on Our Sites and to make it easier for you to use Our Sites when making return visits (for example, when you try to renew your insurance).

We may monitor or record your calls, emails, SMS, or other communications but We will do so in accordance with data protection legislation and other applicable law. Monitoring or recording will always be for business purposes, such as for quality control and training (e.g. where you call Our customer service helpline), to prevent unauthorised use of Our telecommunication systems and Sites, to ensure effective systems operation, to meet any legal obligation and/or to prevent or detect crime.

5. Why do We process your personal information?

​We will only collect and use your personal information (as described in section 4) in accordance with data protection laws. Our grounds for processing your personal information are as follows:

• Contract – Where necessary We will only collect and process your personal information if you have given your consent for Us to do so, for example, We will only send you certain marketing emails and process any sensitive information about you if We have your consent.
• Consent – We process your information where you have given us explicit consent (e.g., for certain marketing communications).
  
• Legitimate Interests – We may use and process some of your personal information where We have sensible and legitimate business grounds for doing so. Under UK privacy laws, there is a concept of “legitimate interests” as a justification for processing your personal information. Our legitimate interests in processing your personal information are:
• To enable you to access and use the Services by searching the websites to obtain quotes; processing any transaction between you and a third party and tracking sales. Using your information in this way is an essential part of Us being able to provide the Services to you;
• To communicate with you about the Services. We need to keep you informed about your use of the Services, for example, sending you a confirmation email of your quotes and renewal notices. This will not include marketing communications unless you have given Us your consent to receive these; and
• To improve Our Services. We may use your personal information to personalise aspects of Our service and for market research. We constantly aim to improve Our Services to you and using your personal information in this way helps Us to do this.

You have a right to object to Our use of your personal information for these legitimate interests, including where We may use your personal information to create a profile to inform customer demographics. If you raise an objection, We will stop processing your personal information unless very exceptional circumstances apply, in which case We will let you know why We are continuing to process your personal information. Please contact Our Customer Services Team if you wish to exercise this right.

​6. Who do We share your personal information with?

 When you use any of Our Services, We may disclose your personal information to the following parties: 

• other associated member companies of Our group;
• Our commercial business partners, any insurers providers (including any regulated insurance companies, managing general agents or the Corporation of Lloyd’s) and other companies whose products or services are featured on Our Sites, with a view to them: (i) providing you with an Insurance product or other services which you have requested. When these companies use your personal information in this way, they will be acting as data controllers (or Joint Data Controllers, alongside Us) of your information and therefore We advise you to read your chosen provider’s Privacy Policy;
• Our channel operators: whilst the majority of the channels on Our Sites are run by Us, some of Our channels are designed and maintained for Us by Our service providers. We may receive your personal information from these service providers and use it in accordance with section 4 above. We will only use the personal information We receive from third parties where the relevant third party can show that it was collected and processed in accordance with the law;
• Other service providers that We engage to help Us provide certain services and/or functionality, such as hosting, data storage, and analytics companies, including those listed in section 8 below;
• Any regulatory or governing bodies, for the purposes of compliance monitoring;
• Where permitted by data protection and privacy law, We may also disclose information about you (including electronic identifiers such as IP addresses) and/or access your account:
• If required or permitted to do so by law;
• If required to do so by any court, or any other applicable regulatory, governing, Governmental or law enforcement agency;
• If necessary in connection with legal proceedings or potential legal proceedings; 
• In connection with the sale or potential sale of all or part of Our business;
• If We reasonably believe false or inaccurate information has been provided and fraud is suspected, details may be passed to any law enforcement or fraud prevention agencies to prevent fraud or financial (or any other type of) crime.

​7. Who might Our providers share your personal information with?

​Some of Our providers will use your personal information to assess your circumstances (including information about any third party who is named on the policy) and verify the information that you have provided to Us. Some providers may carry out checks with fraud prevention and credit reference agencies, both when you first buy your policy and at renewal (insurers generally run these checks to ensure that they can verify your identity, help prevent fraud and money laundering). If providers do these checks, they will be quotation searches only but will be visible to other organisations. Both public data (e.g. the electoral roll) and private data (e.g. your personal credit history) may be checked in this way.

Some providers may carry out checks against data they already hold on you, such as data from existing products, account data, data from previous product transactions, and accounts that you may already hold with them. If you decide to enter into a contract with a provider through any of Our Sites, the information you have provided to Us, together with any further information requested by, and supplied by you or Us to the provider, will be held by the provider for the purposes set out in that provider’s privacy policy. Therefore, you are strongly advised to read your chosen provider’s privacy policy and satisfy yourself as to the purposes for which the provider will use your personal information before entering into the contract. We have no responsibility for the uses to which a provider puts your personal information. 

​8. Third-party data processors

​We use a number of third-parties to process personal data on Our behalf. These third-parties have been carefully chosen and all of them comply with the legislation set out in section 1. Any third parties based in the USA are under appropriate international transfer safeguards (such as SCCs or UK IDTAs, since the EU-US Privacy Shield is no longer valid). We will provide a list of any third-parties upon request. 

​9. What cookies do We use?

​A cookie is a very small text file placed on your computer or device. Cookies help Us to: 

• Understand browsing habits on Our Sites;
• Understand the number of visitors to Our Sites and the pages visited; and
• Remember you when you return to Our Sites, so We can provide you with access to previously saved quotes, or email you quote details.
• Facilitate navigation of Our Sites and retain the information you enter as you move from page to page when obtaining a quote or purchasing a product.

 For more information on the cookies We use, please see Our Cookie Policy.

​10. What advertisement do We show on Our Sites?

​We do not feature third-party advertising on any of Our Sites and there are no third-party cookies deployed for this purpose. We do use Display Advertising, using Google Analytics which permits advertisements and remarketing to be served on third-party websites across the internet relating to a search made on any of Our Sites. 

Our Sites and any third parties, including Google, use first-party cookies and third-party cookies to inform, optimise, and serve such advertisements. You can opt-out of, or customise, these advertisements using the Google Ads Preferences Manager.

​11. How secure is Our site and what steps do We take to keep you safe?

​The security of your personal data is especially important to Us and Our Sites use HTTPS to help keep information about you secure. Security during the transfer is called the Secure Sockets Layer (SSL) and Transport Layer Security (TLS). SSL Certificates are small data files that digitally bind a cryptographic key to an organization’s details. When installed on a web server, it activates the padlock and the https protocol and allows secure connections from a web server to a browser. Typically, SSL is used to secure credit card transactions, data transfer, and logins, and more recently is becoming the norm when securing browsing of social media sites.

However, no data transmission over the internet can be guaranteed to be totally secure. Certain information, for example, your credit card details and personal details, are encrypted to minimise the risk of interception during transit. You may complete a registration process when you sign up to use parts of Our Sites or Mobile Applications. This may include the creation of a username, password, and/or other identification information. Any such details should be kept confidential by you and should not be disclosed to or shared with anyone. Where you do disclose any of these details, you are solely responsible for all activities undertaken on Our Sites where they are used. 

We do Our best to keep the information you disclose to Us secure. However, We cannot guarantee or warrant the security of any information which you send to Us, and you do so at your own risk. By using Our Sites, you accept the inherent risks of providing information online and will not hold Us responsible for any breach of security. 

It might sometimes be necessary for Us to transfer your personal information outside of the UK or European Economic Area (EEA), where appropriate safeguards such as Standard Contractual Clauses (SCCs), International Data Transfer Agreements (IDTAs), or adequacy decisions are in place. to locations that may not provide the same level of protection as the UK. However, We will only transfer your personal information out of the EEA if We have put in place appropriate safeguards and protections as stated under UK law for example by the use of a data-transfer agreement incorporating certain standard model protection clauses.

​12. How can you amend your preferences?

​Any electronic marketing communications We send you will include clear and concise instructions to follow should you wish to unsubscribe at any time. You may also amend your marketing preferences by contacting Our Customer Service Team. Should you no longer wish to be contacted by Us, you can advise Us at any time by contacting Our Customer Services Team by telephone or email. If you no longer wish to be contacted by providers for marketing purposes, please follow the instructions in their marketing communications, or consult their privacy policies for further information about unsubscribing.

​13. Your personal data rights and how to contact Us.

​You have certain rights under existing data protection legislation including:

• Right to access: the right to request copies of your personal information from Us;
• Right to correct: the right to have your personal information rectified if it is inaccurate or incomplete;
• Right to erase: the right to request that We delete or remove your personal information from Our systems;
• Right to restrict Our use of your information: the right to ‘block’ Us from using your personal information or limit the way in which We can use it;
• Right to data portability: the right to request that We move, copy, or transfer your personal information;
• Right to object: the right to object to Our use of your personal information including where We use it for Our legitimate interests or where We use your personal information to carry out profiling to inform Our market research and customer demographics (see section 5 above).

To make enquiries, exercise any of your rights set out in this Privacy Policy and/or make a complaint please contact Our Customer Services Team.

If you are not satisfied with the way any complaint you make in relation to your personal information is handled by Us then you may be able to refer your complaint to the relevant data protection regulator, which in the UK is the Information Commissioner’s Office (for more information please see https://ico.org.uk/ ).

This Privacy Policy shall be governed and construed in all respects in accordance with the laws of England and Wales.

​14. How long do We keep your personal information?

​Unless a longer retention period is required or permitted by law, We will only hold your personal information on Our systems for the period necessary to fulfil the purposes outlined in this Privacy Policy or until you request it is deleted. If having registered for any of Our Services, you do not use them for a reasonable time (which may vary depending on the Services you’ve registered for) We may contact you to ensure you’re still happy to receive communications from Us. Even if We delete your personal information it may persist on backup or archival media for legal, tax or regulatory purposes.

​15. Changes to this Privacy Policy

​We reserve the right to amend or modify this Privacy Policy at any time, and any changes will be published on Our Sites. The date of the most recent revision will appear on this page. If We make significant changes to this policy, We may also notify you by other means such as sending an email. Where required by law We will obtain your consent to make these changes. If you do not agree with any changes, please do not continue to use Our Sites.

 Last updated September 2025