Im-Insured.com Limited
Version 1.0 · Last updated: 30 July 2026
1. About this notice
This notice explains how Im-Insured.com Limited collects, uses, shares and protects your personal information, and what rights you have over it. It applies whenever you use our websites, contact us for a quotation, ask us to arrange or advise on insurance, or hold a policy we have arranged.
We are the data controller for the personal information described in this notice. That means we decide how and why it is used, and we are responsible for looking after it.
| Company name | Im-Insured.com Limited |
| Trading names | I’m Insured, UtterlyCovered.com, Channel Islands Insured |
| Registered office | 3rd Floor, Capital Tower, Greyfriars Road, Cardiff, CF10 3AZ |
| Company number | 07325662 (registered in England and Wales) |
| FCA Firm Reference Number | 534183 — verify at register.fca.org.uk |
| ICO registration number | Z2383131 |
| compare@im-insured.co.uk | |
| Telephone | 029 2271 2773 |
We are authorised and regulated by the Financial Conduct Authority as an insurance intermediary. We handle personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
Who to contact about your information
For any question about this notice, or to exercise any of your rights, contact:
Data Protection Contact
Im-Insured.com Limited, 3rd Floor, Capital Tower, Greyfriars Road, Cardiff, CF10 3AZ
Email: compare@im-insured.co.uk
Telephone: 029 2271 2773
2. The information we collect
The information we need depends on the type of cover you are asking about. We only ask for what we need to give you accurate quotations and advice.
Information that identifies and describes you
Name, any previous names, date of birth, gender, home address and any previous addresses, email address, telephone numbers, marital or relationship status, nationality and residency status, and occupation and employment details.
Information about your circumstances and the cover you need
The amount and type of cover you want, existing policies and providers, mortgage and loan details where relevant, your income, dependants and beneficiaries, retirement plans, and details of your business where you are arranging business or group cover.
Health and lifestyle information — special category data
For life insurance, critical illness cover, income protection, private medical insurance and similar products, insurers require information about your health. This may include your medical history and current conditions, diagnoses, treatments, prescribed medication, height and weight, family medical history, smoking, vaping and alcohol consumption, recreational drug use, hazardous occupations and pastimes, and travel to higher-risk destinations.
Health information is special category data under the UK GDPR and receives additional protection. Section 4 explains the specific legal conditions we rely on to process it.
Financial and payment information
Bank account and payment card details for premium payments, information about your income and outgoings where affordability is relevant, and — for some products — credit or insurance-history search results.
Information about criminal convictions
For certain general insurance products, insurers ask about unspent criminal convictions and about previous insurance fraud, cancellations or refused claims. We collect this only where the insurer requires it.
Information about other people
Where you arrange cover that includes other people — a spouse or partner, your children on a family private medical policy, employees on a group scheme, or named beneficiaries — we will process their information too. If you provide information about someone else, please make sure they know, and show them this notice.
Technical and website information
IP address, device and browser type, operating system, the pages you visit and how you arrived, and information collected through cookies and similar technologies. Our Cookie Policy explains this in detail and how to manage your choices.
Records of our dealings with you
Notes of calls and meetings, call recordings where we tell you a call is being recorded, emails and messages, records of the advice we gave and why, quotations produced, and any complaint you make.
3. Where we get your information from
Most of it comes directly from you — through our website forms, by telephone, email, live chat, or in the course of an application. We may also receive information from:
- Your employer or scheme trustees, where you are a member of a group life, group income protection or group private medical insurance scheme
- Someone acting on your behalf, such as your partner, an accountant, a mortgage adviser or an introducer who referred you to us
- Insurers and product providers on our panel, when they respond to an application, request further information, or notify us about your policy
- Medical professionals, where an insurer requests a report from your GP or a medical examination as part of underwriting — this is always with your specific consent
- Reference and verification services, including identity, anti-fraud and where relevant credit reference agencies
- Publicly available sources, such as Companies House and public registers, mainly for business and group enquiries
4. Health information and other special category data
We cannot arrange most protection or medical insurance without health information, so it is important you understand how we handle it.
The conditions we rely on
For information you give us about yourself, we rely on your explicit consent (Article 9(2)(a) UK GDPR). We will ask for this clearly and separately, and we will explain what we need the information for before you give it.
Where we process health information about people who are not our direct customer — for example family members on a private medical policy, members of a group scheme, or the subject of a business protection policy — we may instead rely on the substantial public interest condition for insurance purposes set out in Schedule 1, Part 2 of the Data Protection Act 2018, because it is not reasonable or practical to obtain each person’s consent. We may also rely on this condition, or on the establishment, exercise or defence of legal claims, where health information is needed to deal with a claim.
For information about criminal convictions we rely on the condition for insurance purposes in Schedule 1 of the Data Protection Act 2018.
Withdrawing consent
You can withdraw your consent to us processing your health information at any time by contacting us. If you do, we will stop unless we have another lawful reason to continue — for example to keep a record of the advice we gave, or to defend a legal claim.
Withdrawing consent does not undo anything done before you withdrew it, and it may mean we can no longer arrange or continue to service your cover. Your insurer’s own privacy notice will explain their position on any policy already in force.
5. How and why we use your information
| Purpose | Information used | Our lawful basis |
|---|---|---|
| Responding to your enquiry and producing quotations | Identity, contact, cover requirements, health and lifestyle | Consent for health information (Art 9(2)(a)); legitimate interests or steps prior to entering a contract for the rest |
| Assessing your needs and giving you advice or a recommendation, where our service is advised | All of the above, plus financial and circumstantial information | Steps prior to entering a contract; consent for health information; legal obligation in respect of our FCA suitability record-keeping duties |
| Submitting your application to an insurer and arranging your policy | All of the above | Contract; consent for health information |
| Servicing your policy, handling amendments, renewals and cancellations, and supporting you with claims | Identity, contact, policy, health, claims information | Contract; legitimate interests; consent or the insurance condition for health information |
| Administering group and business schemes on behalf of an employer or trustees | Employee and member data, scheme details | Contract with the employer; legitimate interests; the insurance condition for health data |
| Verifying your identity and preventing fraud and financial crime | Identity, contact, financial, conviction and fraud-database information | Legal obligation (Money Laundering Regulations 2017); legitimate interests in preventing fraud; the insurance and fraud conditions in the Data Protection Act 2018 |
| Meeting our regulatory obligations, including FCA record-keeping, complaint handling, Consumer Duty monitoring, reporting and audit | Any of the above as relevant | Legal obligation |
| Handling complaints, and dealing with the Financial Ombudsman Service | Identity, contact, policy, correspondence, advice records | Legal obligation; legitimate interests; establishment or defence of legal claims |
| Sending you marketing about our products and services | Identity, contact, product interests | Consent for electronic marketing to prospective customers; legitimate interests for marketing to existing customers about similar products (see section 7) |
| Improving our website and services, and measuring how our marketing performs | Technical, website usage, aggregated enquiry data | Consent where cookies require it; otherwise legitimate interests |
| Training our staff and monitoring quality, including reviewing call recordings | Call recordings, correspondence, advice records | Legitimate interests; legal obligation in respect of our regulatory monitoring duties |
| Managing our business, including accounting, insurance, professional advice and, in the event of a sale or reorganisation, due diligence | Any of the above as relevant | Legitimate interests; legal obligation |
About “legitimate interests”
Where we rely on legitimate interests, we have considered whether our interest is fair to you and whether it overrides your rights and freedoms. Our interests are in running a compliant, well-managed intermediary business, giving you a useful service, and preventing fraud. You can ask us for a summary of any of these assessments, and you have the right to object — see section 10.
6. Who we share your information with
We do not sell your personal information. We share it only where we need to.
Insurers, providers and reinsurers on our panel, so they can quote, underwrite, issue and administer your policy and handle claims. Once your information is with an insurer, they use it as a controller in their own right and under their own privacy notice — we recommend you read it.
Medical professionals and medical screening services, where an insurer requires a GP report, nurse screening or medical examination, and always with your specific consent.
Trustees and employers, where cover is written under a trust or provided through a group scheme.
Service providers who act on our instructions as processors, under written contracts that restrict what they may do with your information. These currently include:
- Website hosting and maintenance
- Our customer relationship management system, Pipedrive, which holds enquiry and client records
- Email, telephony and call-recording providers
- Our live chat provider
- Google Analytics, for website measurement, where you have consented to analytics cookies
- Feefo, our independent review provider, where you consent to be invited to leave a review
- Our marketing and email delivery platform
Introducers and referral partners, where they introduced you to us, limited to confirming the status of the introduction.
Regulators, ombudsmen and authorities, including the Financial Conduct Authority, the Financial Ombudsman Service, the Information Commissioner’s Office, HM Revenue & Customs, the police and other bodies where we are required or permitted to disclose.
Fraud prevention and anti-money-laundering agencies and databases, where required.
Our professional advisers, including auditors, solicitors, accountants and compliance consultants, where they need it to advise us.
Prospective purchasers or investors, and their advisers, if we sell or reorganise our business — on confidential terms and limited to what is necessary for the transaction.
7. Marketing
If you consent, or where you are an existing customer and the law permits it, we may contact you about products and services we think will be useful — for example a review of your existing protection, additional cover, or a scheme renewal.
Email and text message. We will only send you marketing by email or SMS where you have consented, or where you have previously enquired about or bought a similar product from us and we gave you the opportunity to opt out at that point. Every marketing message includes a one-click unsubscribe.
Telephone. Where we call you for marketing purposes we screen against the Telephone Preference Service and, for business numbers, the Corporate Telephone Preference Service, and we respect any registration unless you have told us directly that we may still call.
Post. We may write to you where we have a legitimate interest in doing so and you have not objected.
Third parties. We do not sell or rent your information to third parties for their own marketing.
Opting out
You can opt out at any time — click unsubscribe in any email, reply STOP to any text, or tell us by email or telephone. We will action it promptly and keep a minimal record of your objection so that we do not contact you again by mistake.
Opting out of marketing does not stop us sending you information we are required to send about a policy you hold, such as renewal notices or important changes.
8. Automated decision-making
We do not make decisions about you based solely on automated processing.
Our website and quotation tools use automated calculations to generate indicative prices, but any decision about advice, or about whether cover can be arranged, is made or checked by a person.
Insurers on our panel may use automated underwriting to decide whether to offer cover, on what terms and at what price. Where an insurer makes a decision about you by wholly automated means that has a legal or similarly significant effect, you have the right to be told, to ask for human involvement, to express your point of view and to challenge the decision. The insurer’s privacy notice will explain how, and we will help you raise it with them.
9. How long we keep your information
We keep personal information only as long as we need it, then delete it securely or anonymise it. Our retention periods reflect FCA record-keeping requirements, legal limitation periods and the long-tail nature of protection claims.
| Records | How long we keep them |
|---|---|
| Enquiries and quotations that do not proceed | 24 months from your last contact with us |
| Advice records and suitability documentation for protection and private medical insurance | 6 years from the end of the policy or the end of our relationship, whichever is later |
| Policy and servicing records for pure protection contracts, which can be claimed on many years after the sale | The term of the policy plus 7 years |
| Group and business scheme records | 6 years from the end of the scheme or our appointment |
| Claims records | 6 years from settlement or closure |
| Complaint records | 6 years from the date the complaint was resolved |
| Identity verification and anti-money-laundering records | 5 years from the end of our business relationship |
| Call recordings | 6 years where they relate to an advised sale; otherwise 12 months |
| Accounting and tax records | 6 years plus the current financial year |
| Marketing consents and objections | For as long as the consent is relied on, and a suppression record indefinitely so we do not contact you again |
| Website analytics | As set out in our Cookie Policy |
Where we need to keep information for longer to comply with a legal obligation, or to establish or defend a legal claim, we will keep it for as long as that requires and no longer.
10. Your rights
You have the following rights over your personal information. They are free to exercise, and we will respond within one month — we will tell you if we need longer because a request is complex.
Be informed — to know how we use your information, which is what this notice is for.
Access — to receive a copy of the personal information we hold about you.
Rectification — to have inaccurate information corrected and incomplete information completed.
Erasure — to have your information deleted where we no longer have a good reason to keep it. This right is limited where we must keep records for regulatory or legal reasons.
Restriction — to ask us to pause our use of your information, for example while we investigate a dispute about its accuracy.
Object — to object to processing based on our legitimate interests, and an absolute right to object to direct marketing, which we will always honour.
Portability — to receive information you gave us in a machine-readable form, or to have it transmitted to another organisation, where we processed it by automated means on the basis of consent or a contract.
Withdraw consent — at any time, where we relied on your consent, including consent to process your health information.
Not be subject to solely automated decisions with a legal or similarly significant effect — see section 8.
To exercise any of these, contact us using the details in section 1. We may ask you to verify your identity first, so that we do not disclose your information to the wrong person.
11. International transfers
We aim to keep your personal information in the United Kingdom or the European Economic Area. Some of our service providers process information outside the UK.
Where information is transferred outside the UK, we make sure it is protected by one of the safeguards the law allows — a UK adequacy decision covering the destination country, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures a risk assessment identifies as necessary.
You can ask us for details of the safeguards applying to any specific transfer.
12. How we keep your information secure
We use technical and organisational measures appropriate to the sensitivity of the information we hold, including access controls so staff only see what their role requires, encryption of information in transit and at rest, secure hosting, confidentiality obligations in staff contracts, data protection training, written contracts with our processors, and procedures for identifying, containing and reporting personal data breaches.
Where a breach is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will tell you without undue delay if the risk to you is high.
No transmission over the internet can be guaranteed completely secure. Please do not send us health information, bank details or copies of identity documents by ordinary email unless we have given you a secure method.
13. Children
Our services are aimed at adults aged 18 and over, and we do not market to children. We may process information about children where they are named as beneficiaries, insured as dependants on a family policy, or covered under a group scheme. Where we do, a parent or guardian provides it and we hold it on the same basis as the rest of the policy record.
14. Cookies
Our websites use cookies and similar technologies. We only set non-essential cookies — including analytics and advertising cookies — where you have consented through our cookie banner, and you can change or withdraw your choices at any time using the cookie settings link in our website footer. Our Cookie Policy sets out each cookie we use, its purpose and how long it lasts.
15. If you are in Jersey or Guernsey
We serve customers in the Channel Islands under our Channel Islands Insured trading name. Jersey and Guernsey are separate jurisdictions with their own data protection laws, and you have equivalent rights under them:
- Jersey — the Data Protection (Jersey) Law 2018, overseen by the Jersey Office of the Information Commissioner (JOIC)
- Guernsey — the Data Protection (Bailiwick of Guernsey) Law 2017, overseen by the Office of the Data Protection Authority (ODPA)
The way we handle your information, the purposes we use it for, how long we keep it and the rights set out in section 10 all apply to you in the same way. Where we hold or process your information in the United Kingdom, that transfer is permitted because the UK is recognised as providing an adequate level of protection under both islands’ laws.
You can raise a concern with us using the details in section 1. If you remain dissatisfied you may complain to your local regulator instead of, or as well as, the Information Commissioner’s Office:
Jersey Office of the Information Commissioner
2nd Floor, 5 Castle Street, St Helier, Jersey, JE2 3BT
Telephone: +44 (0)1534 716530 · Website: jerseyoic.org
Office of the Data Protection Authority (Guernsey)
Block B, Lefebvre Court, St Peter Port, Guernsey, GY1 2JP
Telephone: +44 (0)1481 742074 · Website: odpa.gg
Insurance business in the Channel Islands is regulated locally rather than by the Financial Conduct Authority, and the Financial Ombudsman Service does not cover it. If your complaint is about the service or advice you received rather than about your personal information, contact us using the details in section 1 and we will tell you which complaints route applies to you.
16. Changes to this notice
We review this notice at least annually and whenever our processing changes. The version number and date at the top show when it was last updated. Where a change materially affects how we use your information, we will tell you directly.
| Version | Date | Summary of changes |
|---|---|---|
| 1.0 | 30 July 2026 | Full rewrite: added lawful bases, special category data conditions, retention schedule, international transfers, marketing, automated decision-making and Channel Islands sections; corrected registered office details |
17. How to complain
If you are unhappy with how we have handled your personal information, please tell us first using the details in section 1. We will investigate and respond.
If you are dissatisfied with a service issue rather than a data protection issue, our Complaints Procedure explains how to complain and your right to refer the matter to the Financial Ombudsman Service.
If you are in Jersey or Guernsey, see section 15 for your local regulator.
You also have the right to complain to the UK’s data protection regulator at any time:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
