At Compensation4Cyclists, we are committed to protecting your privacy. This policy explains how we collect, use, and safeguard your personal information when you interact with us.
Welcome to the Privacy Policy of Compensation4Cyclists. We are committed to protecting your personal information and respecting your privacy. This policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website, use our services, or interact with us in any way.
This Privacy Policy applies to all personal data we process, regardless of the medium or format. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We will only collect and use your personal data for legitimate purposes, will never sell your data to third parties, and will always respect your privacy rights. Your trust is important to us.
We collect personal information that you voluntarily provide to us when you:
The types of personal information we may collect include:
In the course of handling your claim, we may need to collect special category data, including health information, criminal records, or racial/ethnic origin. We will only process this data with your explicit consent and where legally permitted under UK GDPR.
We use your personal information for the following purposes:
To respond to your enquiries, provide information about our services, and assess the viability of your potential claim.
To manage your claim, gather evidence, instruct expert witnesses, and communicate with third parties on your behalf.
To comply with our legal and regulatory obligations, including SRA requirements, anti-money laundering checks, and court orders.
To send you relevant information about our services, legal updates, and news, with your explicit consent where required.
To improve our website, understand user behaviour, and enhance your browsing experience.
To protect our website, systems, and users from fraud, security threats, and unauthorised access.
Under UK GDPR, we rely on the following legal bases to process your personal data:
Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
Example: Processing your claimProcessing is necessary for compliance with a legal obligation to which we are subject.
Example: SRA compliance, AML checksProcessing is necessary for our legitimate interests or the legitimate interests of a third party, provided your rights do not override those interests.
Example: Website analytics, fraud preventionYou have given clear consent for us to process your personal data for a specific purpose.
Example: Marketing communicationsProcessing is necessary to protect someone's life or physical integrity.
Example: Emergency medical situationsProcessing is necessary for the performance of a task carried out in the public interest.
Example: Statutory reportingWe may share your personal information with the following categories of recipients when necessary:
We do not transfer your personal data outside the UK unless we have implemented appropriate safeguards, such as standard contractual clauses or adequacy decisions, to ensure your data remains protected in accordance with UK GDPR requirements.
We will never sell, rent, or trade your personal information to third parties for marketing purposes. Your trust is important to us.
We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements.
| Data Type | Retention Period | Reason |
|---|---|---|
| Enquiry Data | 2 years | For follow-up and business development |
| Claim Files | 6 years from case closure | Legal and regulatory requirements |
| Medical Records | 7 years from case closure | Medical negligence claims period |
| Financial Records | 7 years | HMRC and tax requirements |
| Marketing Data | Until consent is withdrawn | Consent-based processing |
| Website Analytics | 26 months | Performance analysis |
| CCTV Footage | 30 days | Security monitoring |
You have the right to request the deletion of your personal data in certain circumstances. However, this right is not absolute and may be subject to legal or regulatory retention requirements. We will assess each request on a case-by-case basis.
Under UK GDPR, you have the following rights regarding your personal data. We are committed to helping you exercise these rights.
You have the right to request a copy of the personal data we hold about you, along with information about how we process it. This is known as a Subject Access Request.
You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
You have the right to request that we delete your personal data in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected.
You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest its accuracy.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
You have the right to object to the processing of your personal data where we rely on our legitimate interests or for direct marketing purposes.
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you.
Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time.
To exercise any of your rights, please contact us at:
We will respond to your request within one month, as required by law. In some cases, we may extend this period by two months if the request is complex or we receive multiple requests.
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
All data transmitted through our website is encrypted using SSL/TLS protocols. Data at rest is also encrypted where appropriate.
Access to personal data is restricted to authorised personnel only, based on the principle of least privilege.
We conduct regular security audits and vulnerability assessments to identify and address potential risks.
All staff receive regular training on data protection and information security best practices.
We have an incident response plan in place to handle any data breaches promptly and effectively.
We conduct due diligence on all third-party processors to ensure they meet our security and data protection standards.
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO within 72 hours of becoming aware of the breach, as required by UK GDPR.
Our services are not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately.
If we become aware that we have collected personal information from a child under 16 without verification of parental consent, we will take steps to delete that information as soon as possible.
We may update this Privacy Policy from time to time to reflect changes in technology, legislation, or our business practices. Any changes will be posted on this page with an updated revision date.
We encourage you to review this policy periodically to stay informed about how we protect your privacy. The date at the top of this policy indicates when it was last updated.
If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our Data Protection Officer:
You have the right to lodge a complaint with the ICO if you are unhappy with how we have handled your personal data.
Make a Complaint