Privacy Policy.

Ark Insurance Group Limited is authorised and regulated by the Financial Conduct Authority (FCA) and acts as an insurance intermediary, working with brokers and insurers to arrange insurance products and provide associated services.

For the activities described in this notice, Ark Insurance Group Limited is responsible for personal information where it determines the purposes and means of processing that information. This is referred to as being a data controller.

Insurance brokers, insurers and other organisations involved in the insurance process may also act as separate data controllers for their own activities. Their privacy notices may therefore also apply.

Ark Insurance Group Limited is entered on the FCA Financial Services Register under reference number 706598.

As an insurance intermediary, Ark normally receives personal information through the insurance broker dealing directly with the customer.

Brokers may submit information using Ark's quotation and policy administration systems to obtain quotations, arrange insurance cover and manage relevant policy matters.

Depending on the product or service, information may include:

• Name, address, date of birth and contact information.
• Employment, occupation and business information.
• Income, expenditure and relevant financial circumstances.
• Credit information, county court judgments and adverse financial history.
• Insurance requirements, quotations, existing policies and policy history.
• Previous claims, incidents, losses and relevant insurance disclosures.
• Banking and payment information where required.
• Driving licence details, motoring information and relevant convictions where applicable to the product.
• Property, construction, business, development or other risk information.
• Correspondence, telephone recordings and records of relevant enquiries or transactions.

Where necessary for an insurance purpose, we may also process more sensitive information, such as health information or criminal offence data. Additional legal safeguards apply to that information.

Where relevant and appropriate, we may obtain or verify information using other sources, including public records, brokers, insurers, claims organisations and fraud prevention services.

This may be necessary to confirm identity, verify information provided during an insurance application, assess risks, assist with claims or help prevent fraud.

Visitors can contact Ark Insurance Group Limited directly through our website, including the Contact Us enquiry form.

The form allows visitors to select an enquiry department and provide information relevant to their request. These departments include underwriting, product documentation, claims, compliance, Consumer Code, broker schemes, book transfers, new agency applications and general enquiries.

Information collected through the form

We may collect:

• First name and last name.
• Email address and telephone number, where supplied.
• Company or brokerage details, where applicable.
• Selected department and enquiry type.
• Relevant insurance products, policy or claim references, or business information.
• Property or development details and complaint references for Consumer Code enquiries.
• The message and any other information voluntarily provided.

Why we collect this information

We use website enquiry information to identify the appropriate department, respond to requests, provide information, manage correspondence and, where appropriate, progress a related insurance or complaint matter.

The information is submitted to Ark's website systems and may be transmitted to an appropriate Ark business email account for handling by authorised staff.

Relevant correspondence may be retained where necessary to demonstrate how a request was handled, satisfy regulatory requirements, or protect legitimate business and legal interests.

Consumer Code enquiries

Where an enquiry concerns the New Home Buyers Consumer Code, we may use the details supplied to respond to questions, identify relevant property or warranty information, and assist with the appropriate complaint or dispute-resolution process.

If a matter needs to be referred to a participating builder, an insurer or an independent dispute-resolution provider, relevant information may be shared where appropriate and lawful.

A general website enquiry does not, by itself, constitute a formal application to CEDR or an insurance claim notification.

Security and spam prevention

The website may process limited technical information, such as the IP address associated with a submission, to help protect the form against misuse, automated submissions and excessive requests.

Visitors should not include passwords, payment card details, unnecessary health information or other highly sensitive personal information in a general enquiry form.

We use personal information where necessary and appropriate to:

• Assess insurance requirements and obtain quotations.
• Arrange, administer and support insurance policies.
• Communicate with brokers, insurers and relevant customers.
• Assist with claims and related policy matters.
• Respond to website enquiries and requests for information.
• Manage complaints and Consumer Code enquiries.
• Assess new agency applications, broker arrangements and business opportunities.
• Prevent, detect or investigate suspected fraud and other unlawful activity.
• Meet legal, regulatory and recordkeeping obligations.
• Protect our systems, services and legitimate business interests.

We seek to collect and use only information that is relevant to the purpose concerned.

Under the UK GDPR, personal information must be processed on an appropriate lawful basis. The basis depends on the particular purpose and circumstances.

Legitimate interests

We may rely on legitimate interests where processing is necessary for the effective operation of our insurance intermediary business, handling broker relationships, responding to business enquiries, protecting our systems or preventing misuse, provided those interests are not overridden by individuals' rights and freedoms.

In insurance arrangements involving a broker, legitimate interests may be appropriate for certain activities where Ark is not itself contracting directly with the individual.

Contractual necessity

Where we have a contract with an individual, or take steps at their request before entering into a contract, processing may be necessary for that contractual purpose.

This basis does not automatically apply to individuals merely because they are covered by a contract between other parties.

Legal obligation

We may process and retain information to comply with applicable legal and regulatory obligations, including requirements relating to insurance distribution, complaints handling, financial crime prevention and recordkeeping.

Consent

We rely on consent where required or appropriate for a specific activity, such as certain forms of electronic direct marketing.

Where consent is relied upon, it can be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Website enquiries

Responding to general website enquiries and directing them to the appropriate department will ordinarily be carried out on the basis of our legitimate interests in responding to correspondence and operating our services.

If an enquiry develops into an insurance transaction, formal complaint, legal matter or another regulated activity, additional or different lawful bases may apply to the subsequent processing.

Some insurance products may require information concerning health, medical history or other special categories of personal information.

Processing this information requires an appropriate lawful basis under Article 6 of the UK GDPR and an additional condition under Article 9, together with any applicable provisions of the Data Protection Act 2018.

Depending on the circumstances, the relevant condition may include the substantial public interest condition for insurance purposes under Schedule 1, paragraph 20 of the Data Protection Act 2018, where its requirements are met. Other lawful conditions may apply in appropriate cases.

Information about criminal convictions or offences is subject to separate safeguards and may only be processed where the necessary legal conditions are satisfied.

We seek to limit such processing to information that is necessary for the particular insurance, claims or regulatory purpose.

Personal information may be shared where necessary and lawful with:

• Insurance brokers involved in the relevant transaction.
• Insurers and underwriting organisations.
• Claims handlers, loss adjusters and other claims-related specialists.
• Organisations assisting with insurance administration, communication or technology.
• Fraud prevention organisations and relevant authorities.
• Regulators, courts, law enforcement agencies and other bodies where disclosure is required or permitted by law.
• Relevant parties involved in Consumer Code or dispute-resolution matters, where appropriate.

We may also use service providers that process information on our behalf, subject to appropriate confidentiality, security and contractual safeguards.

We do not sell personal information or disclose it to unrelated third parties for their own marketing purposes.

Ark Insurance Group Limited takes appropriate technical and organisational measures to protect personal information from unauthorised access, alteration, disclosure, accidental loss or destruction.

Information is protected whether held electronically or in physical records, with access restricted according to business need and applicable security procedures.

Where information is stored

Ark Insurance Group Limited does not store personal information outside the European Economic Area (EEA).

We maintain controls over the storage and handling of information and require appropriate protections from service providers processing personal data on our behalf.

Any processing or transfer arrangements involving access from outside the EEA would need to be assessed separately for compliance with applicable UK data protection law.

We retain personal information only for as long as necessary for the purposes for which it was collected, taking account of legal, regulatory, contractual and legitimate business requirements.

Insurance policy records

Where Ark has arranged an insurance policy, the related file, including relevant personal information and associated call recordings, will generally be retained for a minimum of six years in accordance with Ark's established retention policy.

This is a business retention standard informed by applicable regulatory, legal and evidential requirements. It should not be interpreted as a single statutory minimum applying to every insurance record.

Longer-term insurance obligations

Certain policies and transactions may require information to be retained for longer, particularly where long-term warranties, latent defects, ongoing claims, limitation periods, legal proceedings or other continuing obligations are involved.

Where a longer retention period is necessary, we will retain the relevant information only for the justified period and review it in accordance with our recordkeeping requirements.

Website enquiries

General website enquiries that do not develop into insurance transactions, complaints or other regulated matters are retained for a proportionate period based on their nature, the need for follow-up and any relevant legal or business requirements.

Where an enquiry becomes part of a policy, complaint, claim or other formal matter, the applicable retention rules for that matter will apply instead.

Complaints

General data protection complaints will normally be retained for two years following closure, in accordance with Ark's established approach.

Where a complaint concerns the arrangement or administration of an insurance policy, or another regulated matter, records may be retained for six years or longer where necessary to meet applicable obligations or address potential claims.

Retention summary

Once information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.

Under the UK GDPR and applicable data protection legislation, individuals may have the right to:

• Be informed about how personal data is collected and used.
• Access personal data held about them through a Subject Access Request (SAR).
• Request rectification of inaccurate or incomplete personal information.
• Request erasure of personal information where the relevant legal conditions are satisfied.
• Restrict processing in circumstances where that right applies.
• Object to processing based on certain lawful grounds, including legitimate interests.
• Request data portability where the applicable conditions are met.
• Withdraw consent where consent is the lawful basis for processing.
• Exercise rights relating to relevant automated decision-making and profiling.

Subject Access Requests

You may request a copy of personal information we hold about you by contacting our Data Protection Officer.

We will normally respond within one month, subject to any permitted extensions or exemptions. We may need to verify your identity before releasing personal information.

The right to erasure is not absolute. Information may need to be retained where we have an overriding legal, regulatory or other lawful reason to do so.

Ark Insurance Group Limited does not assume that individuals have consented to marketing simply because they have contacted us, requested a quotation or made an enquiry.

Where consent is required, it will be requested separately through a clear affirmative choice. We do not rely on pre-selected consent boxes.

When marketing consent is obtained, we aim to record what was agreed, when it was provided and how it was obtained.

Existing customers

We may ask customers whether they wish to continue receiving information about products or services after their existing insurance relationship has ended.

Prospective customers

People who have expressed interest in a product but have not proceeded may be asked whether they wish to receive future information relevant to their interests.

Other individuals

Where marketing communications relate to regulated products or services, we will comply with the applicable electronic marketing and data protection requirements.

Individuals can withdraw marketing consent or object to direct marketing at any time by contacting Ark using the details below.

We will not disclose personal information to unrelated third parties for their own marketing purposes.

When visitors access our website, limited technical information may be processed to operate the website, maintain security, diagnose technical problems and help prevent misuse.

This may include IP addresses, browser details, technical request information and website security logs.

Our website may use cookies or similar technologies that are necessary for core functions, security or user preferences.

Where cookies or comparable technologies require consent under applicable UK law, we will seek that consent before using them.

This section should be read alongside any separate cookie information or consent controls provided on the website.

If you have concerns about how we have collected, used, stored or shared your personal information, please contact:

Gemma Walsh
Data Protection Officer
Ark Insurance Group Limited

Email: dpo@arkinsurance.co.uk

Telephone: 02476 437611

We will investigate concerns appropriately and seek to resolve them in accordance with our obligations.

Where a complaint concerns an individual member of staff or another party, relevant information may need to be shared to investigate the matter. Requests for confidentiality will be considered where practicable.

Information Commissioner's Office

If you remain concerned about our handling of personal information, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Telephone: 0303 123 1113

Website: www.ico.org.uk ↗

We review our privacy arrangements periodically and update this policy where necessary to reflect changes in our services, systems, processing activities or legal requirements.

Where we intend to use personal information for a materially different purpose, we will assess the relevant lawful basis and provide updated privacy information where required.

For questions about this Privacy Policy, Subject Access Requests, correction or deletion requests, marketing preferences or other data protection matters, please contact our Data Protection Officer.