Privacy Policy

Last updated: 6th August 2026

About this policy

Elm Risk Solutions Limited respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and share personal information when you:

  • visit or use our website;
  • contact us;
  • request information, advice or an insurance quotation;
  • become or apply to become a client;
  • make or discuss an insurance claim;
  • communicate with us in another professional capacity; or
  • interact with our marketing and communications.

It also explains your rights under UK data protection law.

Who we are

Elm Risk Solutions Limited is the controller responsible for the personal information described in this policy.

Elm Risk Solutions Limited is registered in England and Wales under company number 17061709.

Registered office:
Vale House
Green Lane
Hadfield
Glossop
SK13 2DT

Elm Risk Solutions Limited is authorised and regulated by the Financial Conduct Authority. Our Firm Reference Number is 1056858.

Contact details

Telephone: +44 (0)161 457 3557
Email: contact@elmrisksolutions.co.uk

Privacy enquiries should be directed to the Elm Risk Solutions team using the contact details above.

Personal information we may collect

The information we collect depends on the nature of your relationship with us and the insurance products or services you require.

It may include:

Identity and contact information

  • your name;
  • postal address;
  • email address;
  • telephone number;
  • date of birth;
  • title and preferred form of address; and
  • details of other people connected with an insurance policy or enquiry.

Insurance and risk information

  • details of the insurance cover you require;
  • information about your home, vehicles, possessions, business or other assets;
  • details of jewellery, watches, fine art, collections and other valuable items;
  • property ownership and occupancy details;
  • vehicle, marine, aviation, bloodstock or other specialist-risk information;
  • previous insurance policies;
  • claims history;
  • details of incidents, losses or damage;
  • policy requirements, endorsements and coverage preferences; and
  • information required by insurers to assess or administer a risk.

Financial information

  • payment and billing information;
  • premium and policy-payment details;
  • bank or payment information where required;
  • information relevant to affordability, credit or premium-finance arrangements; and
  • details required to prevent fraud, financial crime or non-payment.

We do not intend to collect full payment-card details through the website unless a secure payment service is introduced and clearly identified.

Communications

We may retain information contained in:

  • emails;
  • telephone calls and messages;
  • contact-form submissions;
  • letters;
  • meeting notes;
  • complaints;
  • claims communications; and
  • other correspondence with you.

Calls may be recorded where this is lawful and where you have been informed that recording is taking place.

Website and technical information

When you use our website, we may collect:

  • your IP address;
  • browser and device information;
  • website usage information;
  • pages viewed;
  • referral information;
  • cookie preferences; and
  • information collected through analytics and advertising technologies where these have been enabled and permitted.

Further information is available in our Cookie Policy.

Special-category and sensitive information

Some insurance products or claims may require information about:

  • physical or mental health;
  • disabilities or medical treatment;
  • racial or ethnic origin;
  • religious or philosophical beliefs;
  • sexual life or sexual orientation; or
  • other information classed as special-category data under data protection law.

We will only collect and use this information where it is relevant and lawful to do so.

We may also process information about criminal convictions, offences, allegations, fraud-prevention checks or sanctions where this is required for insurance underwriting, claims handling, regulatory compliance or fraud prevention.

How we collect your information

We may collect personal information:

  • directly from you;
  • through our website or contact form;
  • during telephone calls, meetings or email correspondence;
  • from another person acting on your behalf;
  • from another person included on, or connected with, an insurance policy;
  • from insurers, underwriting agencies, claims handlers or insurance-market participants;
  • from previous insurance brokers;
  • from loss adjusters, valuers, surveyors and other professional advisers;
  • from credit-reference, fraud-prevention or identity-verification services;
  • from publicly available sources;
  • from regulatory, governmental or law-enforcement bodies; and
  • through cookies and similar website technologies.

Where you provide information about another person, you should make sure you are entitled to do so and, where appropriate, make them aware of this policy.

How we use personal information

We may use personal information to:

  • respond to enquiries;
  • understand your circumstances, assets and insurance requirements;
  • provide insurance advice and recommendations;
  • obtain and present insurance quotations;
  • arrange, renew, amend and administer policies;
  • communicate with insurers and other insurance-market participants;
  • collect or arrange payment of premiums;
  • assist with claims and potential claims;
  • handle complaints;
  • maintain accurate client and policy records;
  • manage our relationship with you;
  • meet legal, regulatory and professional obligations;
  • prevent and detect fraud, financial crime and misuse of our services;
  • establish, exercise or defend legal rights;
  • protect our business, systems and website;
  • analyse and improve our services and website;
  • obtain professional or technical support; and
  • send marketing communications where permitted.

Our lawful bases

UK data protection law requires us to identify a lawful basis for using personal information. The basis used will depend on the particular activity.

Contract

We may use personal information where this is necessary:

  • to take steps at your request before entering into a contract; or
  • to perform or administer a contract with you.

This includes providing quotations and arranging, renewing or administering insurance policies.

Legal obligation

We may use personal information where necessary to comply with legal or regulatory obligations, including requirements relating to:

  • financial-services regulation;
  • record keeping;
  • complaints;
  • taxation;
  • sanctions;
  • fraud and financial-crime prevention;
  • regulatory reporting; and
  • responding to lawful requests from authorities.

Legitimate interests

We may use information where it is necessary for our legitimate business interests or those of another organisation, provided those interests are not overridden by your rights.

These interests may include:

  • operating and managing our business;
  • responding to business enquiries;
  • providing appropriate service and support;
  • maintaining accurate records;
  • protecting our systems and preventing fraud;
  • improving our website and services;
  • managing relationships with insurers and professional partners; and
  • establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we consider whether our use is necessary, proportionate and reasonably expected.

Consent

We may rely on your consent for particular activities, including:

  • certain marketing communications;
  • non-essential website cookies and tracking technologies; or
  • particular uses of special-category information where explicit consent is appropriate.

You may withdraw your consent at any time. Withdrawal will not affect processing that took place before consent was withdrawn.

Substantial public interest and legal claims

Where we process special-category information or criminal-offence information, we may rely on an additional condition permitted by law, including:

  • insurance-related purposes;
  • fraud prevention;
  • preventing or detecting unlawful acts;
  • meeting regulatory requirements;
  • safeguarding economic well-being;
  • establishing, exercising or defending legal claims; or
  • your explicit consent, where appropriate.

The exact condition will depend on why the information is required.

Insurance-market information sharing

To provide insurance services, we may need to share information with organisations involved in arranging, underwriting, administering or responding to a policy or claim.

These may include:

  • insurers;
  • underwriting agencies;
  • reinsurers;
  • other insurance brokers;
  • wholesale brokers and insurance-market intermediaries;
  • claims handlers;
  • loss adjusters;
  • surveyors;
  • engineers;
  • repairers;
  • valuers;
  • medical professionals;
  • legal advisers;
  • fraud-prevention organisations; and
  • regulatory or industry bodies.

Those organisations may act as independent controllers of your information and may provide their own privacy notices.

We will only disclose information that is reasonably necessary for the relevant purpose.

Other organisations we may share information with

We may also share information with:

  • website, hosting and IT-support providers;
  • email and communication providers;
  • customer and insurance-record management systems;
  • document-storage providers;
  • professional advisers, including accountants, auditors and lawyers;
  • payment, banking and premium-finance providers;
  • identity, credit and fraud-prevention services;
  • analytics and advertising providers where permitted;
  • regulators, courts, law-enforcement agencies and public authorities;
  • potential purchasers, investors or advisers involved in a business sale, restructuring or transfer; and
  • other organisations where you ask or authorise us to share information.

Organisations processing information on our behalf must be subject to appropriate contractual and security requirements.

We do not sell your personal information.

White-labelled and external insurer services

Our website may in future provide links to white-labelled insurance services, insurer portals or other external services.

Although these services may be presented through or linked from the Elm Risk Solutions website, the relevant insurer or provider may collect and use personal information as a separate controller.

You should review the privacy information presented when you access or use the relevant service.

This policy will be reviewed when any such service is introduced.

Marketing

We may use your contact details to send information about Elm Risk Solutions, relevant insurance services or other information we believe may be of interest.

Where electronic marketing consent is required, we will ask for it before sending those communications. In limited circumstances, the law may permit marketing to existing clients about similar services, provided the applicable requirements have been met.

Marketing communications will identify Elm Risk Solutions and provide a way to unsubscribe.

You can ask us to stop using your information for direct marketing at any time by:

Your right to object to the use of personal information for direct marketing is absolute.

Service, policy, claims and regulatory messages are not marketing and may still be sent where necessary.

Cookies and website analytics

Our website uses cookies and similar technologies.

Strictly necessary technologies may be used to operate and protect the website and remember your privacy choices.

Where enabled, non-essential technologies such as Google Analytics 4, Meta Pixel, LinkedIn Insight Tag or Google Ads tracking will be controlled in accordance with our Cookie Policy and the choices made through our cookie controls.

Please refer to our Cookie Policy for further information.

International transfers

Some organisations providing technology, insurance, analytics or other services may process personal information outside the United Kingdom.

Where a restricted international transfer takes place, we will use a lawful transfer mechanism. This may include:

  • transferring information to a country covered by UK adequacy regulations;
  • using the UK International Data Transfer Agreement;
  • using the UK Addendum to approved EU standard contractual clauses; or
  • relying on another permitted safeguard or exception.

Where required, relevant transfer-risk assessments will also be completed.

You may contact us for further information about the safeguards relevant to your information.

How long we retain information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, regulatory, insurance-market, accounting and reporting requirements.

The period may depend on:

  • whether you become a client;
  • the duration of an insurance policy;
  • the possibility of a claim arising after a policy has ended;
  • applicable limitation periods;
  • regulatory and legal record-keeping requirements;
  • the nature and sensitivity of the information; and
  • whether the information is required to establish, exercise or defend legal rights.

When information is no longer required, we will delete it, anonymise it or securely restrict its use.

Information security

We use appropriate technical and organisational measures designed to protect personal information against:

  • unauthorised access;
  • accidental loss;
  • misuse;
  • alteration;
  • disclosure; and
  • destruction.

Access to personal information is restricted to people and service providers who need it for legitimate purposes.

No internet-based service can be guaranteed to be completely secure. You should avoid including unnecessary sensitive information in a general website contact form.

Your rights

Depending on the circumstances, you may have the right to:

  • be informed about how your information is used;
  • request access to your personal information;
  • ask us to correct inaccurate or incomplete information;
  • ask us to erase information;
  • ask us to restrict its use;
  • object to particular uses of your information;
  • receive certain information in a portable format;
  • withdraw consent where processing relies on consent; and
  • ask for human intervention where a significant decision has been made solely by automated means.

These rights are not absolute and may be subject to legal or regulatory exceptions.

To exercise a right, contact:

Email: contact@elmrisksolutions.co.uk
Telephone: +44 (0)161 457 3557

We may need to ask for information to verify your identity before responding.

Automated decision-making

Elm Risk Solutions does not currently make decisions that produce legal or similarly significant effects solely through automated processing.

However, insurers, finance providers, fraud-prevention organisations or external portals may use automated systems when assessing risk, eligibility, pricing, fraud or credit.

Where this occurs, the relevant provider should explain its use of automated decision-making in its own privacy notice.

Complaints about our use of personal information

Please contact the Elm Risk Solutions team if you have a concern about how we have used your personal information.

Email: contact@elmrisksolutions.co.uk
Telephone: +44 (0)161 457 3557

We will acknowledge a data protection complaint within the applicable legal timeframe, investigate it appropriately and keep you informed of the outcome. Changes taking effect under the Data (Use and Access) Act require organisations to offer a clear complaint route and acknowledge complaints within 30 days.

You also have the right to complain to the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: ico.org.uk

We would appreciate the opportunity to address your concern before you contact the ICO, but you are not required to contact us first.

Changes to this policy

We may update this Privacy Policy when:

  • our services or business operations change;
  • new insurers, systems or external services are introduced;
  • our website or marketing technologies change; or
  • legal or regulatory requirements are updated.

The date at the top of this page shows when the policy was last updated.