Privacy Notice
This is the privacy notice of Park Commercial Limited, registered in England and Wales under company number 06632144, whose registered office is at Synergy House, 1 Artemis Court, St Johns Road, Meadowfield, Durham DH7 8XQ, and which is authorised and regulated by the Financial Conduct Authority under firm reference number 498255. We are referred to as we, us or our throughout this notice.
Version 8 – October 2026. Draft for approval; replaces Version 7 of July 2023.
This privacy notice sets out how we collect and process your personal data. It also provides certain information we are legally required to give you, and lists the rights you have over your personal data.
It relates to personal information that identifies you as a person — whether you are a customer, someone thinking about becoming one, someone who browses our website, or someone outside our organisation with whom we deal. We call that information your personal data throughout this notice.
The privacy and security of your personal information is very important to us, and we want to assure you that it will be properly managed and protected by us at all times. Please read this notice carefully: it explains how we may collect and use your personal data.
We review this notice at least every two years, and whenever we change how we use personal data. Please check it from time to time.
We are the controller of your personal data. For the purposes of data protection law, that means we decide how and why it is used, and we use it in accordance with this notice.
Data protection contact. Questions about your personal data, and any request to exercise the rights set out in section 8, should go to David Park on 0191 378 7100 or at enquiries@parkcommercial.co.uk. You can also write to us at the registered office address above. We are not required to appoint a Data Protection Officer and have not appointed one; David Park is the person responsible for data protection at Park Commercial.
What information we hold about you, and where we get it from. The personal data we collect about you may include:
We may also obtain special categories of personal data about you, and data about criminal convictions. Section 3 sets out how we handle those.
We collect your personal data from you when we obtain quotations for you, when we set up your policy, and when we make changes to it. That may also involve collecting data from or about other people connected with your insurance — others insured under your policies, or your employees or representatives. If you give us information about someone else so that we can arrange insurance covering them — a named driver, an employee, a travel companion — you are confirming that you have their permission to do so and that you have shown them this privacy notice. If the information relates to a child, you are confirming that you are the child’s responsible guardian.
We also collect information from publicly available sources, and from third-party databases made available to the insurance industry to reduce fraud and financial crime, where those third parties have a lawful basis for sharing it with us.
Where we are relying on a basis other than your consent, we rely on one or more of the following.
| Why we process your personal data | The basis on which we can do this (what the law allows) |
|---|---|
| To perform our contractual obligations to you, including obtaining insurance for you, making mid-term adjustments and obtaining renewals | The processing is necessary in connection with a contract you may enter into with us |
| To administer your account, including financial transactions for insurance broking | The processing is necessary in connection with a contract you may enter into with us |
| To help prevent and reduce fraud and other financial crime | The processing is necessary for us to comply with the law and our legal obligations |
| In the interests of security and to improve our service - telephone calls you make to us may be monitored or recorded | The processing is necessary to pursue our legitimate interest in the management and operation of our business |
| To let you know about similar products and services that may be of interest to you | The processing is necessary to pursue our legitimate interest in operating our business |
| To make automated decisions, carry out automated profiling and detect fraud | The processing is necessary in connection with some contracts you may enter into with us |
Where an insurer makes an automated decision about your insurance, that decision is usually a price or an acceptance decision, reached by applying the insurer’s underwriting rules to the information you have given us and to information from the fraud-prevention and credit registers described in section 4. The consequence for you may be a higher or lower premium, a condition attached to the policy, or a decision not to offer cover at all.
You can ask us to confirm that an automated decision has been made, to explain it to you, and to have it reviewed by a person rather than by a system. Section 8 sets out how.
Some personal data is treated as a special category by data protection law and is subject to stricter rules. In arranging and administering insurance we may need to collect special category data about you, which may include information about your health, personal data revealing racial or ethnic origin, religious or philosophical beliefs or trade union membership, and genetic data. In practice, health data is the category we encounter most often, usually in connection with a claim.
We may also collect information about criminal convictions, which we may share with third parties. Our lawful basis for processing both is that the processing is necessary for reasons of substantial public interest relating to insurance purposes.
Insurance purposes means (a) advising on, arranging, underwriting or administering an insurance contract, (b) administering a claim under an insurance contract, or (c) exercising a right or complying with an obligation arising in connection with an insurance contract, including one arising under an enactment or a rule of law.
We may need to pass your personal data to other organisations, which may include:
The information you share with us may be transferred by us, or by any of the organisations listed above, to other countries so that processing can take place, including countries outside the United Kingdom.
We will only do so where the transfer is covered by UK adequacy regulations, by an International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses, or by another safeguard permitted by UK data protection law. You can ask us for a copy of the safeguard that applies to a transfer of your data and we will provide it.
We keep your personal data for as long as we need it, and no longer. In practice that means for the life of your policy, and then for as long afterwards as a claim under the policy or a complaint about our advice could still be brought — against us or against your insurer — together with any longer period that a law or a regulator requires us to keep a particular record.
When a period ends, the data is securely deleted or anonymised. You can ask us what period applies to a particular record and we will tell you.
When you visit our website we may collect information such as your email address, your IP address — a unique address identifying a device on the internet or a local network — and other online identifiers. This helps us track unique visits and monitor patterns of traffic: who visits, and why.
We may use third parties to collate IP addresses to help us understand our internet traffic data, and data about your browser type and device. We may also use web usage information to create statistical data about the use of our website, and we may use or disclose that statistical data for marketing and strategic development purposes — but no individual is identified in it.
We may use cookies and pixel tags on some pages of our website. A cookie is a small text file sent to the device you use to visit the site. A pixel tag is an invisible tag placed on a page, rather than on your device, and usually works together with cookies.
We may also use cookies and pixel tags in our email communications, to personalise a message and to see whether it has been opened and whether any links in it have been used. This lets us monitor and improve both our emails and our website.
Our Cookie Policy sets out the cookies this website uses, what each one does, how long it lasts, and how to refuse or remove them. Cookies that are not essential to the working of the site are set only with your consent.
The open nature of the internet is such that data may travel over networks without security measures, and may be accessed and used by people other than those for whom it is intended. While that is outside our control, we take the protection of your information very seriously and aim to apply appropriate levels of security at all times.
CCTV. Where CCTV is used, we have identified and documented the potential impact on individuals’ privacy and have taken that into account in installing and operating the system, and we review regularly whether CCTV is still the right security measure. We make our use of CCTV clear to those affected, keep recorded images only for long enough to allow an incident to come to light and be investigated, store them securely, limit access to authorised individuals, and check that the system is working correctly. One named person is responsible for its operation. We will respond to anyone asking for a copy of their own images, and will seek prompt advice from the Information Commissioner where there is any uncertainty.
Telephone recording. Where telephone conversations are recorded, we tell you at the beginning of the call, together with our reasons; if you object, please say so immediately. Recordings are stored securely for no longer than necessary, and you have the right to ask for a copy where one is still available. Recordings are passed to third parties only where we have a legal right or a legal obligation to do so.
Payment card data is protected in accordance with the Payment Card Industry Data Security Standard (PCI DSS). Our system prevents us from recording Sensitive Authentication Data, and where that is not possible the data is deleted immediately after the card is authorised.
You have a number of rights over the personal information we hold, and you may ask us to observe them. In some cases we may not be able to do what you ask — because doing so would stop us meeting a legal or regulatory obligation, or because a law sets a minimum period for which we must keep the information. If that happens, we will tell you and explain why.
You can ask us to:
There is no charge for exercising any of these rights, and you do not have to give a reason. Contact David Park using the details in section 2. If you would find it easier to receive our response in large print, in audio or in another format, say so and we will provide it that way.
If you have a question or concern about this notice or about your data protection rights, please contact us first — we would rather hear about it and put it right. You also have the right to make an enquiry or complain to the Information Commissioner’s Office if you are unhappy with our use of your data or you think we have breached a legal requirement. Further details are at ico.org.uk. Our complaints procedure applies to a data protection complaint in the same way as to any other.
From time to time we may use your personal data to tell you about similar products and services that may be of interest to you. We do this because we value your custom and pride ourselves on professional, tailored advice that meets your specific insurance needs — which includes keeping you informed about insurance and industry developments, and about offers or promotions relating to the services we provide to you.
Our lawful basis is that this is necessary to pursue the legitimate interests of our business, unless we have obtained your consent instead. Where the law requires your consent before we send you electronic marketing, we will ask for it and record it, and you can withdraw it at any time.
We may contact you by post, telephone or email. You can tell us to stop at any time, and we will. Doing so will not affect us contacting you about the servicing of products you have asked us for.
David Park is our data protection contact. Call 0191 378 7100, email enquiries@parkcommercial.co.uk, or write to Synergy House, 1 Artemis Court, St Johns Road, Meadowfield, Durham DH7 8XQ.
