Smart Cover Logo

Call Us

03333 449 559

Privacy Policy

Smart Cover is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, how we use it, and your rights under UK data protection law.

Last updated 1 June 2026
Section 1

Who we are

This Privacy Policy applies to Smart Cover Insurance Services, a trading name of Smart-Cover Direct Limited ("Smart Cover", "we", "us", "our"). Smart-Cover Direct Limited is incorporated in England and Wales and is the data controller for all personal data collected through this website and in connection with the provision of our insurance services.

We are registered with the Information Commissioner's Office (ICO) as a data controller in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Smart-Cover Direct Limited is also authorised and regulated by the Financial Conduct Authority (FCA) as an Appointed Representative of City and Commercial Limited (FRN 314346). Our FCA Firm Reference Number is 600428.

Registered Name
Smart-Cover Direct Limited
Principal Address
Citibase, 42–44 Clarendon Road, Watford, WD17 1JJ
Registered Address
Ashley Court, 32 Main Street, Ashley, Leicestershire, LE16 8HF
Email
enquiries@smart-cover.co.uk
Telephone
03333 449 559
FCA Reference
FRN 600428 · Verify on FCA Register
ICO Registration
Registered UK Data Controller · ico.org.uk
Section 2

Personal data we collect

We collect and process the following categories of personal data in connection with our insurance services:

Identity and contact data

  • Full name and title
  • Home address and postcode
  • Email address and telephone number(s)
  • Date of birth (for identity verification)
  • Correspondence records (emails, letters, call recordings)

Policy and property data

  • Insured property address and property type
  • Details of appliances, boiler make, model, and age
  • Motor vehicle registration details (for motor breakdown cover)
  • Policy number, cover type, and plan details
  • Claims history, including details of emergency repairs and callouts
  • Landlord status and number of rental properties (for landlord cover)

Financial and payment data

  • Bank account and sort code (for direct debit collection)
  • Card details (processed securely via our payment provider - we do not store raw card numbers)
  • Payment history and billing records

Technical and usage data

  • IP address and browser type
  • Pages visited, time on site, and click behaviour (via analytics cookies)
  • Device type and operating system
  • Referring website or search term used to reach smart-cover.co.uk
  • App usage data (if you use the Smart Cover mobile app)

Special category data: We do not routinely collect special category data (e.g. health data, ethnicity, religion). Where a claim involves medical circumstances relevant to the cover (e.g. vulnerability of a household member), this data is collected only with your explicit consent and processed solely for the purpose of delivering the service.

Section 3

How we collect your data

We collect personal data through the following means:

  • Directly from you - when you request a quote, purchase a policy, make a claim, call our helpline, complete a form on our website, or interact with us by email or post.
  • Automated technologies - when you visit smart-cover.co.uk, we automatically collect technical data through cookies and similar tracking technologies. See Section 9 for details.
  • Price comparison websites - if you reach Smart Cover through a price comparison website (such as MoneySuperMarket or GoCompare), we receive data entered on those platforms to generate your quote.
  • Third parties - in limited circumstances, we may receive data from fraud prevention agencies, credit reference agencies, or other insurers for the purpose of validating claims or preventing fraud.
  • From the Smart Cover mobile app - when you use our iOS or Android app to manage your policy or raise a claim.

We do not purchase marketing data lists or acquire personal data from data brokers for the purpose of unsolicited direct marketing.

Section 4

Lawful bases for processing

Under UK GDPR, we are required to have a lawful basis for every processing activity. We rely on the following lawful bases:

Contract Performance
Processing necessary to perform our insurance contract with you - issuing your policy, processing your claim, dispatching engineers, and handling your renewal. This is the primary basis for most processing.
Legal Obligation
Processing required by law, including FCA regulatory reporting, anti-money laundering checks, financial crime prevention obligations under POCA 2002, and cooperation with law enforcement.
Legitimate Interests
Processing where we have a legitimate business interest that does not override your rights - including fraud detection, improving our services, website analytics, and sending renewal reminders. We conduct a Legitimate Interests Assessment (LIA) before relying on this basis.
Consent
For optional marketing communications (email, SMS, post) and for non-essential cookies. You may withdraw consent at any time without affecting processing already carried out on another lawful basis.
Vital Interests
In rare circumstances where processing is necessary to protect someone's life - for example, sharing data with emergency services in an extreme home emergency scenario.
Section 5

How We Keep Your Data Secure

We take the security of your personal data seriously and implement appropriate technical and organisational measures, in line with Article 32 of the UK GDPR, to protect it against unauthorised access, accidental loss, alteration, disclosure or destruction. These measures are proportionate to the nature of the data we process and are reviewed regularly. They include the following:

Secure email and communications

We use email security controls designed to prevent email fraud, protect sensitive communications and limit data exposure. These include encryption of emails in transit (TLS), anti-spoofing and email authentication protocols (such as SPF, DKIM and DMARC) to help prevent fraudulent emails being sent in our name, spam and malware filtering on inbound mail, and access controls that restrict who within our business can view communications containing personal data.

Please be alert to phishing: we will never email or call you asking for your full payment card details or online account passwords. If you receive a suspicious communication claiming to be from Smart Cover, do not respond to it - contact us directly on 03333 449 559to verify it.

Website and systems security

Our website and the systems that support it are protected by a range of security measures, including:

  • Encryption in transit - our website is served over HTTPS (SSL/TLS), so information you submit through our forms is encrypted between your browser and our servers.
  • Security monitoring and protection tools - we use website security and firewall technologies to monitor for, block and remove malicious activity, malware and unauthorised access attempts.
  • Patching and updates - our software, platforms and any third-party components are kept up to date with security patches.
  • Access controls - personal data is accessible only to those members of staff and service providers who need it to perform their role, protected by authentication controls.
  • Data minimisation and retention controls - we collect only the data we need and retain it only for as long as necessary for the purposes described in this policy or as required by law and regulation.

Where we use third-party service providers to process personal data on our behalf, we require them to implement equivalent security measures and to process your data only on our documented instructions, under contracts that comply with Article 28 of the UK GDPR.

Consent management and your privacy choices

Our website uses a consent management tool to support your privacy rights. When you first visit our website, you will be asked to choose which categories of cookies and similar technologies you are happy for us to use. Strictly necessary cookies are always active because the website cannot function without them; all other categories (such as analytics and marketing) are used only with your consent.

You can change your mind at any time - you can review or withdraw your cookie consent through the cookie settings link on our website, and we keep a record of the consent choices you make so that we can demonstrate compliance. For more detail on the specific cookies we use and how long they last, please see our Cookie Policy.

If something goes wrong

In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office without undue delay and, where required, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to you personally, we will also inform you directly without undue delay, along with the steps we are taking and any steps you can take to protect yourself.

Section 6

Sharing your personal data

We share personal data with the following categories of third parties, only to the extent necessary for the stated purpose:

Underwriters
Your insured risk data is shared with our underwriting partners (including the insurer of record) to bind cover and administer your policy. These entities act as separate data controllers or joint controllers for their part of the processing.
Engineers & Contractors
Your name, address, and contact details are shared with vetted engineers and tradespeople from our nationwide network when dispatching them to resolve your claim. They are contractually bound to use this data only for that purpose.
Payment Processors
Payment data is processed by our PCI-DSS Level 1 compliant payment service provider. We do not store raw card or bank account numbers on our systems.
Technology Providers
We use software providers for our CRM system, policy management platform, email delivery, and website analytics. These providers process data on our behalf as data processors under contracts that include UK GDPR data processing agreements.
Fraud Prevention Agencies
Claims and identity data may be shared with the Insurance Fraud Bureau (IFB) and other industry fraud prevention databases to detect and prevent fraudulent activity.
Regulatory Authorities
We share data with the Financial Conduct Authority, the Information Commissioner's Office, the Financial Ombudsman Service, and law enforcement agencies where required by law or regulatory obligation.
Appointed Representative Network
As an Appointed Representative of City and Commercial Limited (FRN 314346), we share data with our principal firm for regulatory oversight and compliance monitoring purposes.

We do not sell your personal data. Smart Cover does not sell, rent, or trade your personal data to any third party for marketing purposes. Any sharing is strictly necessary for the provision of your insurance service or is required by law.

International transfers: We store and process your data in the United Kingdom. Where any data transfer outside the UK is necessary (for example, to a software provider with infrastructure in the EEA or another country), we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTAs) or equivalent approved transfer mechanisms.

Section 7

How long we keep your data

We retain personal data only for as long as necessary for the purpose for which it was collected, in line with legal, regulatory, and operational requirements.

Active policy data
Retained for the full duration of your policy.
Post-policy data
Retained for up to 7 years after the policy ends - in line with the FCA's record-keeping rules and the Limitation Act 1980 (which permits legal claims within 6 years of an event).
Claims records
Retained for up to 7 years from the date of the claim, or longer if required for litigation, regulatory investigation, or fraud prevention.
Call recordings
Retained for up to 12 months for quality assurance, dispute resolution, and FCA compliance purposes.
Website analytics
Aggregated analytics data is retained for up to 26 months. Individual-level data is anonymised or deleted sooner.
Marketing consent records
Retained for as long as necessary to evidence consent, or until you withdraw it - whichever comes first.
Fraud prevention data
Where data is held by fraud prevention agencies, their own retention periods apply - typically up to 6 years.

When data is no longer required, it is securely deleted or anonymised in accordance with our data retention and disposal procedure. Anonymised data (from which you cannot be identified) may be retained indefinitely for statistical and analytical purposes.

Section 8

Your data protection rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data. We will respond to requests free of charge within one month, extendable to three months for complex requests.

Right to Be Informed
You have the right to know how we collect, use, share and store your personal data. This privacy policy is how we provide that information.
Right of Access (SAR)
Request a copy of all personal data we hold about you. We will provide it in a commonly used format within one calendar month.
Right to Rectification
Ask us to correct inaccurate or incomplete personal data held about you. We will update records promptly.
Right to Erasure
Request deletion of your personal data where there is no overriding legal obligation requiring us to retain it. Note: we may need to keep certain data to comply with FCA regulatory requirements.
Right to Restrict Processing
Ask us to stop actively processing your data - for example, while you contest its accuracy. We will continue to store it but not use it until the matter is resolved.
Right to Data Portability
Receive data you have provided to us in a structured, machine-readable format (where processing is based on consent or contract) and transfer it to another controller.
Right to Object
Object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we have compelling legitimate grounds that override your interests.
Rights on Automated Decisions
Request human review of any significant decision made solely by automated means. Smart Cover does not currently make solely automated decisions that produce significant legal effects.
Right to Withdraw Consent
Where processing is based on consent (e.g. marketing), you may withdraw at any time by contacting us or clicking "unsubscribe" in any marketing email.

How to exercise your rights

To exercise any of these rights, please contact us:

We will respond to your request within one calendar month of receiving it. If your request is particularly complex, or you have made multiple requests, we may extend this by up to two further months - if so, we will tell you within the first month and explain why. To protect your data, we may need to verify your identity before acting on your request; we will only ask for the minimum information necessary to do so.

We will not charge a fee for handling your request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or refuse to act on the request, and we will explain our reasons.

Your right to complain

If you are unhappy with how we have handled your personal data or a rights request, please contact us first so we can try to resolve the matter. You also have the right to lodge a complaint with the UK's supervisory authority at any time:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline
0303 123 1113
Website
ico.org.uk
Section 9

Cookies and tracking technologies

Smart Cover uses cookies and similar tracking technologies on smart-cover.co.uk and the Smart Cover app. A cookie is a small data file placed on your device that helps our website function correctly and provides us with analytics about how the site is used.

We use the following categories of cookies:

Cookie Category Purpose Examples Consent Required?
Essential Required Enable core website functions - login sessions, shopping cart, security tokens. The site cannot function without these. Session ID, CSRF tokens, load balancer cookies No - necessary for the site to work
Analytics Optional Help us understand how visitors use the site - pages visited, journey paths, time on site, and error identification. Google Analytics (_ga, _gid), Hotjar Yes - consent required
Marketing Optional Track users across websites to deliver relevant advertising and measure the performance of marketing campaigns. Google Ads, Meta Pixel, Bing Ads Yes - consent required
Functional Optional Remember your preferences (language, region, accessibility settings) to personalise your experience. Preference cookies, live chat session Yes - consent required

You can manage your cookie preferences at any time by clicking the "Cookie Settings" link in the footer of this website. You can also control cookies through your browser settings, though disabling essential cookies will affect site functionality.

For full details of every cookie we use, including names, durations, and providers, please see our Cookie Policy.

Section 10

Marketing communications & consent

Smart Cover may contact you about our products and services by email, SMS, telephone, or post. The lawful basis for this processing depends on your relationship with us:

  • Existing customers - we may contact you about similar products or services under the "soft opt-in" rule (Regulation 22 of PECR), unless you have opted out.
  • Prospects - we will only contact you for marketing purposes if you have given your explicit consent.
  • Renewal reminders - we will contact you before your policy renewal date. This is a legitimate business activity and is not classified as direct marketing.

You can opt out of marketing at any time by:

Note: Opting out of marketing will not affect service communications related to your active policy - such as engineer appointment confirmations, policy documents, and billing notifications. These are necessary for the administration of your contract.

Section 11

How we protect your data

Smart Cover takes the security of your personal data seriously. We have implemented appropriate technical and organisational measures to protect your data against unauthorised access, accidental loss, alteration, disclosure, or destruction.

  • Encryption - all data transmitted between your browser and our website is encrypted using TLS (Transport Layer Security). Sensitive data at rest is encrypted at the database level.
  • Access controls - personal data is accessible only to employees and contractors who need it to perform their role. Access is controlled through role-based permissions and multi-factor authentication.
  • Payment security - we use a PCI-DSS Level 1 compliant payment processor. We do not store card numbers or CVV codes on our systems.
  • Staff training - all staff who handle personal data receive regular data protection training in line with UK GDPR requirements.
  • Data processor contracts - all third parties who process data on our behalf are bound by data processing agreements that require equivalent security standards.
  • Incident response - we maintain a data breach response procedure. In the event of a breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay.

Whilst we take every reasonable precaution, no method of transmission over the internet is completely secure. If you have concerns about the security of your data, please contact us at enquiries@smart-cover.co.uk.

Section 12

Third-party websites and links

Our website may contain links to third-party websites, including price comparison platforms, review sites, and the websites of our partners and regulators. This Privacy Policy applies only to smart-cover.co.uk and the Smart Cover mobile app.

When you click a link to a third-party website, you are leaving our site and the privacy practices of that third party will apply. We are not responsible for the privacy policies or content of external websites. We recommend reviewing the privacy policy of any third-party website you visit.

Third-party websites linked from this site include (but are not limited to): the FCA Register (register.fca.org.uk), the ICO (ico.org.uk), the Financial Ombudsman Service (financial-ombudsman.org.uk), MoneySuperMarket, and GoCompare.

Section 13

Changes to this Privacy Policy

We review and update this Privacy Policy regularly to reflect changes in our data practices, legal obligations, or regulatory guidance. The date at the top of this policy indicates when it was last updated.

Where changes are material - meaning they significantly affect how we use your personal data or your rights - we will notify you by email (if you are an existing customer) and/or by a prominent notice on this website before the changes take effect.

For minor updates (such as clarifications of existing practices or contact detail changes), we will update this page and revise the "Last Updated" date. We encourage you to review this policy periodically.

Continued use of our website or services after a policy update constitutes acceptance of the revised policy. If you do not accept the revised terms, you should stop using our services and contact us to exercise your data rights.

Current version
Version 4.0 - 1 June 2026
Previous version
Version 3.2 - 1 January 2025
Reason for update
Updated to reflect FCA Consumer Duty obligations, expansion of appliance cover to include smart home devices, and revised data retention schedules.
Section 14

Contact us & how to complain

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how we have handled your personal data, please contact us:

Smart Cover Data Protection Contact

Email
enquiries@smart-cover.co.uk
Phone
03333 449 559
Post
Citibase, 42–44 Clarendon Road, Watford, WD17 1JJ
Reference
FCA FRN 600428 · ICO Registered

We will acknowledge your request within 5 business days and aim to resolve it within one calendar month. For complex requests, we may extend this to three months - we will inform you if this applies.

Right to complain to the ICO: If you are not satisfied with our response to your data protection concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) - the UK's data protection supervisory authority:

ICO Website
ico.org.uk
ICO Helpline
0303 123 1113 (Monday–Friday, 9am–5pm)
ICO Post
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

You also retain the right to seek a judicial remedy in the courts of England and Wales if you believe that your rights under UK GDPR have been infringed.