Privacy Notice

About this Privacy Notice

This Privacy Notice explains how Enterprise Insurance collects, uses, shares and protects personal data. It applies to the products and services we offer including car insurance arranged by Enterprise Insurance and the administration of Financial Guaranteed Asset Protection (FGAP) policies administered by Enterprise Claims.

It also explains the rights you have in relation to your personal data and how to raise a concern or complaint if you are unhappy with the way your information has been handled.

Who we are

In this Privacy Notice, "we", "us" and "our" refer to Enterprise Innovation Holdings Limited, including the trading styles Enterprise Insurance and Enterprise Claims.

Depending on the service you receive, we may:

• arrange car insurance and related ancillary products;
• provide claims management services in relation to third-party insurance products; and
• arrange credit with a partnered lender to allow you to pay insurance premiums monthly.

Enterprise Insurance also specialises in helping customers obtain insurance products suitable for leased vehicles.

Our role when using your personal data

Our legal role in relation to your personal data depends on the service we are providing.

Where we determine why and how personal data is used in connection with our own insurance-related activities, we will generally act as a data controller.

Where we process personal data on behalf of another organisation, for example when Enterprise Claims administers claims or policies for an insurer or product provider, we will generally act as a data processor and follow that organisation's instructions.

In some circumstances we may act jointly with another organisation in determining how personal data is used. Where this applies, the relevant organisations will each have responsibilities under data protection law.

How to contact us about data protection

Enterprise Insurance has appointed a Data Protection Officer. You can contact us about data protection matters at:

Exchange Street Buildings, 35-37 Exchange Street, Norwich, England, NR2 1DP

customerservice@enterpriseinsurance.co.uk

Other data controllers

When we obtain insurance quotations from our selected panel of insurers, the insurer will also process your personal data for its own purposes. Where you choose to pay for insurance monthly, the lender providing the finance will also process your personal data in connection with that finance arrangement.

For more information about how the insurers and product providers on our panel use personal data, please refer to their privacy notices below.

If your insurer or product provider is not listed above, please contact us at customerservice@enterpriseinsurance.co.uk.

When we act as a data processor

Operating as Enterprise Claims, we also handle claims and policy administration in relation to GAP insurance policies on behalf of insurers and product providers.

When we act as a data processor, the relevant insurer or product provider remains responsible for determining the purposes for which your personal data is processed. We process the information in accordance with their instructions.

Typically, we receive GAP policy details so that we can administer a claim. We may ask you to complete a claim form and provide supporting documentation so that the claim can be validated and processed.

Data collected for claim handling will normally be retained for seven years, or for another period where instructed by the relevant data controller.

Who this notice applies to

This Privacy Notice applies to anyone whose personal data we collect, including:

• a person requesting a quotation for, or purchasing, an insurance policy;
• a person making an adjustment to or claim under an insurance policy;
• a person making an adjustment to or claim under a Guaranteed Asset Protection policy;
• another person involved in an insurance claim; and
• anyone you authorise to act on your behalf in relation to the services we provide.

When requesting an insurance quote, you should only provide details of named drivers where you have authority to do so. This includes any sensitive personal data you provide about them. You should also make them aware of this Privacy Notice.

Personal data we collect

Information you provide to us

We collect personal data that you provide when we prepare a quotation, arrange or administer insurance, deal with an insurance claim or accident aftercare service, or when you otherwise contact or communicate with us.

Depending on the product or service, as well as your name, age, address and vehicle details, this may include information about criminal convictions or pending convictions and information about certain medical conditions.

We may record telephone calls. Call recordings and other records of your communications with us form part of your personal data.

We may also record information about your interactions with us, such as the date, time, duration and source of calls, the IP address used to access our website and information about interactions with emails we send. We may use this information to operate and improve our services, detect fraud and deal with complaints.

Our website may use cookies and similar technologies. Further information about website cookies can be provided in our online cookie information or settings.

Information we collect from other organisations

We may receive personal data about you from a third party. For example, a finance provider may provide information following an application for vehicle finance where that information is relevant to providing you with an insurance quotation. Where appropriate, we will tell you the source of the information when we contact you.

As part of arranging or administering insurance or handling a claim, we, insurers or product providers may also obtain information from:

• your vehicle manufacturer or dealer;
• suppliers providing services connected with your policy or claim, such as repairers and roadside recovery agents;
• other parties involved in an accident and their insurers;
• the Motor Insurance Database (MID);
• the Claims and Underwriting Exchange (CUE);
• the Motor Insurance Anti-Fraud and Theft Register (MIAFTR);
• the DVLA and MyLicence;
• credit reference and identity verification agencies;
• the LexisNexis NCD Database (or similar services) for verification of No Claims Discount;
• emergency services, police, medical and legal practices; and
• where relevant, a vehicle telematics provider for a usage-based product or add-on.

How we use your personal data

We use personal data where necessary to provide the products and services you request, to meet our contractual and legal obligations, to follow the instructions of a data controller where we act as a processor, and for legitimate business purposes where those interests are not overridden by your rights and interests.

This may include using your data to:

• provide insurance quotations, including sharing information with one or more insurers;
• arrange, administer and renew insurance policies;
• administer policy features, including usage-based or telematics products where relevant;
• price and underwrite motor insurance;
• verify identity and carry out fraud prevention and detection checks;
• recover debts;
• handle and resolve complaints;
• research and develop products and services;
• evaluate insurers, suppliers and service providers;
• analyse and improve the services we provide;
• use automated methods to support decisions about products, services or administration;
• contact you about promotions in which you have participated; and
• tell you about significant changes to this Privacy Notice.

Where we rely on legitimate interests, you may have a right to object to that processing. More information is set out in the section on your rights below.

How we protect your personal data

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

These measures include, where appropriate:

• restricting access to personal data to authorised personnel who need it for their role;
• using appropriate security controls for our systems and networks;
• requiring employees and service providers to keep personal data confidential;
• carrying out appropriate checks on suppliers who process personal data on our behalf;
• putting contractual data protection requirements in place with relevant suppliers and processors;
• maintaining appropriate backup, access control and information security arrangements; and
• reviewing our data protection and information security arrangements regularly.

Where we use third-party service providers to process personal data, we require them to apply appropriate security measures and to process personal data only in accordance with our instructions and applicable data protection law.

Marketing

Where permitted by law, we may contact existing customers or people who have requested a quotation about similar products and services. Where consent is required, we will only send marketing where you have given that consent.

You can change your marketing preferences at any time by using the unsubscribe option in a marketing email or by contacting customerservice@enterpriseinsurance.co.uk.

Who we share personal data with

We, and where relevant the insurers or product providers we work with, may share personal data with third parties where this is necessary in connection with a product or service, an insurance contract, a claim, or another legitimate business purpose.

Recipients may include:

• your vehicle manufacturer or car dealer;
• insurers and product providers;
• claims administrators and other insurance ancillary service providers;
• finance providers;
• marketing service providers;
• IT and technology providers;
• providers of regulatory compliance services;
• the Motor Insurance Database, Claims and Underwriting Exchange and Motor Insurance Anti-Fraud and Theft Register;
• NCD Database providers;
• emergency services; and
• our professional/legal advisers.

Where we appoint suppliers to process personal data on our behalf, we will require them to handle that data appropriately and in accordance with applicable data protection requirements.

International transfers

Our services may involve personal data being processed or stored outside the UK, including by insurers, technology providers or other suppliers. Where personal data is transferred internationally, we will take steps to ensure that appropriate protections are in place in accordance with applicable data protection law.

How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected and to meet legal, regulatory, contractual and claims-related requirements.

If you do not enter into an insurance contract with us, we will normally delete or anonymise your data during the third year after you last provided or updated it, unless there is a reason to retain it for longer, for example in connection with a complaint or legal matter.

Where an insurance contract is arranged, personal data may need to be retained for longer because claims or other legal matters can arise after the policy has ended. As a general rule, policy data will be retained for no longer than seven years unless there is a lawful reason or an instruction from a relevant data controller requiring a different retention period.

Your data protection rights

Depending on the circumstances, you may have the following rights in relation to your personal data:

Right to be informed

You have the right to clear information about how your personal data is used. This Privacy Notice is intended to provide that information. If you have questions, please contact customerservice@enterpriseinsurance.co.uk.

Right of access

You can ask us whether we process your personal data and request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request. We will normally respond within one month, subject to any permitted extension under data protection law.

Right to rectification

You can ask us to correct personal data that is inaccurate or complete information that is incomplete.

Right to erasure

You can ask us to delete your personal data in certain circumstances, for example where the information is no longer needed for the purpose for which it was collected or where processing was based on consent and that consent has been withdrawn. This right does not apply where we have a lawful reason to retain the information.

Right to restrict processing

You can ask us to restrict the use of your personal data in certain circumstances, including while we investigate an issue concerning its accuracy or where you have objected to the processing.

Right to object

You may object to processing based on our legitimate interests. We will consider your request and will stop the processing unless there is a lawful reason for us to continue.

If your request relates to personal data that is controlled by another organisation, we may need to refer your request to that organisation or help you contact them.

How to complain

If you are unhappy with how we have handled your personal data, please contact us so that we can try to resolve your concern.

You also have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113 or 01625 545 745
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

This Privacy Notice was last updated on 1 September 2026.