Privacy Policy

This privacy policy is about the way information may be collected; processed and used by ourselves or third parties.

Who are we? 

Your privacy is very important to us. This privacy notice (“Privacy Notice”) is provided by N D Toy & Partners. References to “We”, “Our” or “Us” in this privacy notice are references to N D Toy & Partners.  We are a controller of your personal data under applicable data protection laws, including from the 25th of May 2018, the General Data Protection Regulation (“GDPR”). We, as a controller, determine why and how we collect and use your personal data.

What is the purpose of this Privacy Notice?

 When you request a quotation for insurance purposes we collect information about you which constitutes personal data under the GDPR. This privacy notice explains how we collect, use, share and protect your personal data. Please read this privacy notice carefully to understand what we do with your personal data.  We may from time to time change this privacy notice and if we make any material changes then we will make the updated privacy notice available to you on our website or by other means. The date at the top of this Privacy Notice indicates from when this Privacy Notice applies.

The terms used  in this Privacy Notice are based on the Information Commissioner’s Office, you can find out more about the ICO at

Whose personal data do we collect? 

We collect and process personal data about individuals who may be current, prospective or former clients for the purpose of quoting and the arranging of insurance contracts.

What kind of personal data do we collect? 

The personal data that we collect from you is listed below together with any other information that we ask you to provide in proposal forms and statements of fact.

Examples of Data received includes:

• Name
• Date of birth
• Address
• Email address
• Phone number
• Marital status
• Financial history
• Bank account details
• Health conditions
• Criminal & motoring convictions
• Insurance history

How do we collect your personal data? 

We may collect your personal data when you:

(i) provide it to us on a proposal form, fact find or related documents

(ii) provide it to us in correspondence.

Where does the data come from? 

From personal clients who are active clients, prospective clients and clients who have previously purchased insurance contracts through the firm.

Do we collect personal data about you from Third Parties? 

We may also collect your personal data such as your name, residential address and other contact or authentication information from third party sources such as credit reference agencies, claims and underwriting exchange (CUE), Motor Insurance database (MID), Driver and Vehicle Licencing Agency  (DVLA) and  Motor Insurance Anti-Fraud Theft Register (MIAFTR) databases to establish and confirm information supplied on the proposal forms and statements of fact.

How will we use your personal data? 

This section of the Privacy Notice explains what we use your personal data for and on which legal basis we rely, to ensure that we process your personal data lawfully. Our legal basis for collecting and using your personal data will include:

(i) Your personal data is processed for the purpose of facilitating entry into a contract of insurance between you and the insurer, arranged by us as the Agent. 

Examples of activities include:

1. Insurance quotations
2. Presentations to insurers
3. Statements of Fact
4. Proposal Forms
5. Mid-term adjustments
6. Renewal Invitations
7. Demands & Needs summaries

(ii) We arrange credit finance for insurance premiums and share your personal data and bank details with Close Brothers Premium Finance.

How is this data recorded? 

Data is collected and recorded on our computer database and is kept on this database:

• for 24 months if no contract is entered into,
• if a contract is entered into then it is retained for a period of 7 years after such contract terminates unless you request that we remove this data. 
• In some cases data is recorded on paper fact finds and proposal forms, once these documents have been scanned into our database the documents are securely disposed of.

Who do we share your personal data with? 

We may share your personal data for the purposes described in this Privacy Notice with:

• Insurers
• Close Brothers Premium Finance
• Tyl By Natwest
• Credit reference agencies
• Claims management companies

We may also disclose your personal data for the purposes set out in this Privacy Notice to other third parties including but not limited to, Courts, government agencies, Employer’s Liability Tracing Office (ELTO) and the Motor Insurance Bureau (MIB), Tax and other regulatory authorities, where we are legally obliged to do so or in our reasonable opinion such disclosure is necessary to comply with applicable laws and legal processes, support an investigation or to protect our rights and interests.

The data that we collect about you may be transferred to, and stored at, a destination outside of the European Economic Area (“EEA”). It may also be processed by staff operating outside of the EEA, who work for one of our suppliers. Such staff may be engaged in, amongst other things, the provision of information that you have requested.

How do we protect your personal data? 

To protect the security of your personal data we implement appropriate technical and organisational security measures which include physical and technical safeguards and governance model that ensures that adequate policies, procedures and controls are in place within our organisation.

Data sent to insurers by Electronic Data Interchange (EDI), Email, telephone conversation or letter will be retained securely as per our Terms of business agreement with the relevant insurers, bank or agencies.

What happens to the data after it has been processed? 

Your personal data is hosted and stored at a Tier 3 data centre serviced by Software Solution Partners Ltd (SSP) your data is retained on the system under your customer record for a period of:

• 7 years after the termination of an insurance contract or
• 24 months if no contract is entered into.

The database is backed up no less than once a day to a secure off-site location.

What are your rights in relation to the personal data we hold about you? 

Subject to the conditions prescribed in applicable laws, you have the right:

(i) to access, rectify or request erasure of your personal data.

(ii) to ask us to restrict processing of it.

(iii) to request portability of it.

(iv) to object, on grounds relating to your particular situation, to processing of your personal data which is based on our or a third parties legitimate interests.

(v) to object to processing of your personal data for direct marketing purposes.

You can exercise these rights by contacting us at N D Toy & Partners Clock House, Main Street, Pembroke. SA71 4NP by phone on 01646681236 or email to

You also have the right to lodge a complaint with a supervisory authority about our use of your personal data if you consider that the processing of your personal data infringes the GDPR.