At Compensation4Cyclists, we take your privacy seriously. This policy explains how we collect, use, and protect your personal data in accordance with UK GDPR and the Data Protection Act 2018.
Compensation4Cyclists (referred to as "we", "us", or "our") is committed to protecting the privacy and security of your personal information. This Data Protection Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website or engage with our services.
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy applies to all personal data we process, regardless of the medium or format.
We are committed to transparency, fairness, and accountability in our data processing activities. We will only collect and use your personal data for legitimate purposes and will always respect your privacy rights.
Compensation4Cyclists is the data controller for all personal data processed through our website and services. This means we are responsible for deciding how and why your personal data is processed.
We collect personal data that you voluntarily provide to us when you:
The types of personal data we may collect include:
In the course of handling your claim, we may collect special category data, including health information, criminal records, or racial/ethnic origin. We will only process this data with your explicit consent and where legally permitted.
We use your personal data for the following purposes:
To respond to your enquiries, provide information about our services, and assess your potential claim.
To manage your claim, gather evidence, instruct experts, and communicate with third parties on your behalf.
To comply with our legal and regulatory obligations, including SRA requirements and anti-money laundering checks.
To send you relevant information about our services, with your consent where required.
To improve our website, understand user behaviour, and enhance your experience.
To protect our website and systems from fraud, security threats, and unauthorised access.
We process your personal data on the following legal bases under UK GDPR:
Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
Example: Processing your claimProcessing is necessary for compliance with a legal obligation to which we are subject.
Example: SRA compliance, AML checksProcessing is necessary for our legitimate interests or the legitimate interests of a third party, provided your rights do not override those interests.
Example: Website analytics, fraud preventionYou have given clear consent for us to process your personal data for a specific purpose.
Example: Marketing communicationsWe may share your personal data with the following categories of recipients:
We do not transfer your personal data outside the UK unless we have implemented appropriate safeguards, such as standard contractual clauses or adequacy decisions, to ensure your data remains protected.
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements.
| Data Type | Retention Period | Reason |
|---|---|---|
| Enquiry Data | 2 years | For follow-up and business development |
| Claim Files | 6 years from case closure | Legal and regulatory requirements |
| Medical Records | 7 years from case closure | Medical negligence claims period |
| Financial Records | 7 years | HMRC and tax requirements |
| Marketing Data | Until consent is withdrawn | Consent-based processing |
| Website Analytics | 26 months | Performance analysis |
You have the right to request the deletion of your personal data in certain circumstances. However, this right is not absolute and may be subject to legal or regulatory retention requirements.
Under UK GDPR, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you, along with information about how we process it.
You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
You have the right to request that we delete your personal data in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected.
You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest its accuracy.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
You have the right to object to the processing of your personal data where we rely on our legitimate interests or for direct marketing purposes.
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you.
Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time.
To exercise any of your rights, please contact us at privacy@inslaw.co.uk or call us on 0161 825 9980. We will respond to your request within one month, as required by law.
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
All data transmitted through our website is encrypted using SSL/TLS protocols. Data at rest is also encrypted where appropriate.
Access to personal data is restricted to authorised personnel only, based on the principle of least privilege.
We conduct regular security audits and vulnerability assessments to identify and address potential risks.
All staff receive regular training on data protection and information security best practices.
We have an incident response plan in place to handle any data breaches promptly and effectively.
We conduct due diligence on all third-party processors to ensure they meet our security and data protection standards.
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO within 72 hours of becoming aware of the breach, as required by UK GDPR.
If you have any questions, concerns, or requests regarding this Data Protection Policy or our data processing practices, please contact our Data Protection Officer:
You have the right to lodge a complaint with the ICO if you are unhappy with how we have handled your personal data.
Make a Complaint