Skip to content

Data Privacy Policy

1. Scope 

1.1 This Privacy Policy tells you what personal information CT InsureTech (“CTI”,” we”, “us” or “our”) collects, why we collect it, what we do with it and who we share it with, as well as the choices and rights individuals have regarding this personal information. 

1.2 This Policy does not apply to the personal information that we process about our employees, which is subject to different respective employee privacy policies. 

2. About CTI 

2.1 CTI specialise in providing software systems and services to large and complex insurers and brokers, tailored to enhance their GWP, CoR, and compliance (our “Services”). The insurers and brokers CTI work with are the Data Controller for your personal information processed through these Services. This means they determine the personal information collected, entered into the system, and the purposes for which it is used. Unless you are explicitly informed otherwise CTI acts solely as Data Processor, processing personal information only on the instructions of the relevant insurer or broker for the purposes they have determined. 

2.2 We are committed to processing personal information in accordance with applicable data protection laws and the core principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability. 

2.3 We regularly review our records of processing activities and data inventories to ensure that the personal information we process remains relevant, adequate and limited to what is necessary for the purposes for which it is used. Where our processing activities are likely to result in a high risk to individuals’ rights and freedoms, we contact Data Protection Impact Assessments to identify, assess and mitigate privacy risks. 

2.4 This Policy explains how CTI handles the personal information that is subject to the UK GDPR, which we collect about individuals: 

  • That use our websites and associated Services  
  • Who are our former, current and prospective clients 
  • Who communicate with us 
  • Who otherwise use our products or engage with us regarding our Services 
  • Other individuals whose personal information we receive in providing the Services 

4. Personal information we collect 

4.1 We collect personal information from a number of sources, depending on how you interact with us and how our software is used.  

We may receive personal information directly from you or from the organisation you work for, for example when you: 

  • Contact us with an enquiry 
  • Request a demonstration or information about our services 
  • Become a customer 
  • Create or use an account to access our services 
  • Contact our support or customer service teams 
  • Communicate with us regarding a business relationship 

The information collected may include business contact and professional information including your name, business and email address, business telephone number, job title, employer and other information contained in your communication with us. 

4.2 We may receive and process information from insurers, brokers and other organisations (“Customers”) that may use our software according to their own requirements. In these circumstances, we generally act as data processor on behalf of these Customers, who act as data controllers and determine the purposes and means of processing. The nature of the information they may enter is determined by how the Customers intend to use it. This may include personal information relating to their employees, customers, policyholders, brokers or other individuals. These Customers are responsible for ensuring that they have an appropriate lawful basis and provide you with any required privacy information in relation to their use of the software. 

4.3 Any processing CTI carries our will be subject to our contractual arrangements with these organisations and their instructions.  

4.4 The website and our services are not intended for children under the age of 18. We do not knowingly process data of children under the age of 18. 

5. Purposes and legal grounds for our use of personal information 

5.1 We use business contact information to manage business relationships, including to communicate with Customers, prospective Customers, suppliers and business contacts, provide information about our services, arrange meetings and demonstrations, and provide Customer support.  

5.2 We have set out more information about the legal bases for processing in the table below. For the below purposes of processing CTI is Data Controller.  

Purpose of processing Types of personal data Lawful basis 
Managing business relationships, including communicating with Customers, prospective Customers, suppliers and other business contacts Name, business contact details, job title, employer and other professional information Legitimate interests 
Providing information about our products and services, including responding to enquiries and arranging demonstrations Name, business contact details, job title, employer and enquiry details Legitimate interests and consent where required for direct marketing 
Customer support  Name, business contact details, job title, employer and account-related information Performance of a contract and Legitimate interests  
Complying with legal and regulatory obligations  Business contact and professional information Legitimate interests 

7. With whom might we share your personal information? 

7.1 We store your data in data centres and cloud storage provides based in xxx 

Need to understand if we will share information outside of the UK/EEA. 

If so – adequacy, SCC’s 

When we transfer personal data outside of the UK/EEA, we ensure that there are adequate technical and organisational measures and legal safeguards in place to protect your personal data. This will include the UK or EU adequacy decision, the EU/Uk Data Privacy Framework (DPF) or approved Standard Contractual Clauses (SCCs). 

9. Artificial Intelligence  

9.1 We may use Artificial Intelligence (“AI”) to help improve our services, and support functions such as for data analytics or to enhance performance. 

9.2 This may involve the use of your personal information. When AI tools process personal data, we ensure that such processing is carried out in accordance with applicable data protection laws. 

9.3 We may also use AI to help improve our business and provide a better service. We implement appropriate safeguards such as data minimisation, access controls, and human oversight to ensure that any AI-assistant processing remains transparent, fair and secure. 

9.4 We use various types of AI, which vary based on your relationship with us and the relevant service offered. Where appropriate, additional information will be provided to you to help understand where AI is being used and how any decisions based on AI are made. 

10. Social Media 

10.1 We use a third-party provider, HubSpot, to manage our social media interactions and opt-in/opt-out preferences. If you send us a private or direct message via social media, it will be stores by HubSpot for up to 12 months. 

10.2 We see all this information and decide how we manage it. For example, if you send a message via social media that needs a response from us, we may process it as an enquiry or a complaint. When contacting CTI through a social media platform, we suggest you also familiarise yourself with the privacy information on that platform. 

10.3 HubSpot provides us with analytics information on engagement with our social media presence. 

11. Direct Marketing 

11.1 Where we use your personal information for direct marketing purposes (for example, to inform you about CTI news, events or services), and you have previously expressed an interest in, or enquired about, similar services, we may send you such marketing by email under the “soft opt in” provisions of the Privacy and Electronic Communications Regulations (PECR). This allows us to rely on our legitimate interests to send marketing relating to similar products or services, provided that we gave you the opportunity to opt out at the time your details were collected and include an opt out option in every marketing communication. 

We may also send direct marketing emails to you on the basis of our legitimate interests where the communication is considered “business to business” (B2B) marketing under PECR. 

11.2 In all other cases, we will only undertake direct marketing activities via email where we have your consent to do so. In these emails you will always have the opportunity to opt-out of receiving further direct marketing communications from us. You can also contact dpo@ct-insuretech.com if you wish to opt-out of future marketing communications 

12. How long do we keep records for? 

12.1 We will not retain personal information for the purposes described for longer than is necessary for the purposes for which they were collected. We have a data retention policy in place and data will be retained in line with the timeframes outlined within this policy, or in line with client contractual requirements.  

12.2 We may retain personal information for longer periods where necessary to establish, exercise or defend legal claims, comply with regulatory obligations, respond to legal requests, or otherwise meet legal and business record keeping requirements.  

13. Automated decision making 

3.1 In carrying out the processing described in this privacy policy, we do not make any decisions about individuals (which would have a legal or similar significant effect) based solely on automated processing of their personal data.  

14. Your rights 

14.1 You have the following rights in relation to the information about you which we process as described in this notice: 

Right of Access You can ask us to confirm whether we are processing your personal information and provide you with a copy of that information together with certain other details. 
Correction You can ask us to correct inaccurate personal information, in which case we may seek to verify the accuracy of the information before correcting it. 
Erasure You can ask us to delete your personal information in some circumstances such as where we no longer need it or if you withdraw your consent (where applicable). 
Restriction You can ask us to restrict (to store but not use) your personal data in certain circumstances, such as where its accuracy is contested and we are taking steps to review or verify its accuracy. We can continue to use your personal information following a request for restriction, where necessary to establish, exercise or defend legal claims, or to protect the rights of another natural or legal person. 
Portability You have the right, in certain circumstances to obtain your personal information you have provided to us in a structured, commonly used, machine-readable format, or you can ask to have it ‘ported’ directly to another data controller, but only where our processing is based on your consent and the processing is carried out by automated means. 
Objection You can object to any processing of your personal information which has our ‘legitimate interests’ as its legal basis, if you believe your fundamental rights and freedoms outweigh our legitimate interests. Once you have objected, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms. In addition, you can object to the processing of your personal information for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing without providing any reason. We will then stop processing of your personal information for direct marketing purposes. 
Withdrawal of Consent Where processing is based on your consent, you may withdraw your consent however we may not be able to process your claim if you do so. 

14.2 You may exercise any of the rights described above by contacting our Data Protection Officer using the details set out below. 

14.3 We will respond to your request within one month and will usually be able to fulfil your request within that time unless your request is complicated. If it is complicated, we may need to extend the deadline for responding to you to three months in total form the date of your initial request. In that case, we will let you know when you should expect our response. Generally, there is no fee for making these requests. 

14.4 You should keep in mind that, depending on the right you want to exercise, and the type of personal data involved, there may be legal reasons why we cannot meet your request. 

15. What security measures we take  

15.1 We take information security seriously. We have implemented appropriate safeguards and technical measures to protect the security, confidentiality and integrity of the personal information we collect and maintain.  

15.2 Our information security programme incorporates recognised industry standards, including ISO 27001, and we maintain a culture of privacy and security awareness. Personal information is only accessible to CTI staff and service provides with a legitimate business need to access it.   

16. How do I contact the Data Protection Officer 

3.1 We are committed to processing all personal data fairly, lawfully, and transparently. We have appointed a Data Protection Officer (“DPO”) to oversee compliance with data protection law. If you have any questions about this Policy, please contact our DPO: 

dpo@charlestaylor.com 
2 Minster Court 
Mincing Lane 
London 
EC3R 7BB  

17. Your right to complaint to our supervisory authority 

17.1 We work conscientiously to handle your personal data responsibly. For UK residents, if you are unhappy with the way we are handling your personal data, please contact our DPO in the first instance who will try to address your concerns. If you remain dissatisfied with how we have investigated your complaint, you have a right to escalate your complaint to the UK’s data protection supervisory authority: 

Information Commissioner’s Office 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 5AF 

Helpline number: 0303 123 1113  

Website: https://www.ico.org.uk/make-a-complaint 

17.2 We may update this Privacy Policy from time to time and will post changes by updating it together with the effective date on this page. We encourage you to review this website and this Policy periodically to understand how we process your personal information. 

17.3 This Policy comes into effect <insert full date>. Once effective, the revised policy will apply to you and your personal information. Further information can be found in our Cookie Policy and Terms and Conditions. 

17.4 For those that work at CTI, the CTI Privacy Policy for Employees are accessible on the company HR system. Our Candidate Privacy Policy is also available on this website.  

Issued by  xxx  
Region UK 
Owner xxx 
Reviewed  Annually  
Version and Issue Date TBC