Privacy Policy
Who we are
HeckinGood Limited is an FCA-authorised insurance broker registered in England and Wales.
Company number: 12790905
Registered address: Jenners, Slaugham, Haywards Heath, England, RH17 6AQ
FCA Firm Reference Number: 1013447
For the purposes of UK data protection law, HeckinGood Limited is the data controller - we decide how and why your personal data is used.
Our products are underwritten by Fortegra Insurance UK Ltd. (Company No. 15182608, of 20 Fenchurch Street, 5th Floor, London, England EC3M 3BY), referred to in this policy as "Fortegra UK". Where Fortegra UK processes your data in connection with your policy, they are an independent data controller for those processing activities. Their privacy notice is available on their website at fortegra.com.
What personal data we collect
We collect personal data about you in the following categories:
Identity and contact data
- Full name, date of birth
- Home address, email address, phone number
Policy and pet data
- Your pet's name, species, breed, age and postcode
- Your policy history, including renewals and any changes you make
- Claims history and documentation (including vet invoices and clinical notes shared with your consent)
Financial data
- Payment method (card type, last four digits) - your full card details are processed and stored securely by our payment provider, Stripe; HeckinGood does not store them
- Bank account details where a refund is paid by bank transfer
Technical and usage data
- IP address, browser type, device information
- Pages visited on our website, time spent, referral source
- Cookie identifiers (see Section 9)
Communications data
- Records of emails, calls or messages you send to us
- Records of any support requests or complaints
Fraud and sanctions data
- Information checked against fraud prevention databases and sanctions lists, as required by law
How we use your data and our legal basis
UK data protection law requires us to have a lawful basis every time we use your personal data. The table below explains what we use your data for and which legal basis applies.
Purpose | Our legal basis |
|---|---|
Providing you with a quote and arranging your policy | Performance of a contract - it is necessary to fulfil the insurance contract with you |
Administering your policy, processing renewals and mid-term changes | Performance of a contract |
Processing your claims, including passing data to our claims system and your vet | Performance of a contract |
Processing payments and issuing refunds | Performance of a contract |
Sending you policy documents, payment confirmations and important notices | Performance of a contract |
Screening your details against sanctions and financial crime lists | Legal obligation - we are required to do this by anti-money laundering and sanctions regulations |
Detecting and preventing fraud | Legitimate interests - we have a legitimate interest in protecting our customers and our business from fraud and financial crime |
Reporting to the FCA, FOS and other regulatory bodies | Legal obligation |
Improving our website and services through analytics | Legitimate interests - we have a legitimate interest in understanding how our services are used so we can improve them |
Sending you marketing communications (with your consent) | Consent - you can withdraw this at any time |
Handling complaints and enquiries | Legitimate interests / legal obligation |
Where we rely on legitimate interests, we have assessed that our use of your data is proportionate and does not override your rights and freedoms. You can ask us for more detail about this assessment at any time.
Who we share your data with
We only share your data where there is a clear and lawful reason to do so. We do not sell your personal data to third parties.
Fortegra UK (insurer)
As the underwriter of your policy, Fortegra UK requires your personal and policy data to assess risk, administer your policy, and make decisions on claims. They are an independent data controller for these purposes.
Wisentic (claims technology)
We use Wisentic's AI-powered platform to process claims. Wisentic acts as our data processor, operating under a formal data processing agreement in line with UK GDPR requirements. Your claims data (including vet invoices and clinical notes) is passed to Wisentic to enable automated and manual claims assessment.
Insly (platform provider)
Insly is our London-headquartered quote, buy and policy administration platform provider. It processes personal data on our behalf as a data processor.
Stripe (payment processing)
Stripe processes your payment details on our behalf. They are PCI DSS Level 1 certified. HeckinGood does not store your full card details.
Sanction Search (sanctions screening)
We use Sanction Search to screen against financial sanctions lists, as required by UK law. This is an automated check and does not result in a credit search on your file.
Fraud prevention agencies
We may share data with fraud prevention agencies and the Insurance Fraud Bureau where we suspect fraud or are required to do so by law. These organisations may use the data to prevent fraud and money laundering, and to verify your identity. If we share data with a fraud prevention agency, this may affect your ability to obtain insurance or other financial products in the future.
Veterinary practices
Where you submit a claim, we will share relevant policy information with your vet and may request clinical records from them, with your consent given at the point of claim submission.
Regulatory and legal authorities
We may share your data with the Financial Conduct Authority (FCA), Financial Ombudsman Service (FOS), Financial Services Compensation Scheme (FSCS), or law enforcement agencies where required by law or regulation.
Google Analytics (website analytics)
If you consent to analytics cookies, we use Google Analytics, provided by Google Ireland Limited, to understand how visitors use our website. Google acts as our data processor for this purpose - see Section 9 for more on cookies.
Business transfers
If HeckinGood is involved in a merger, acquisition or sale of assets, your data may be transferred to the relevant parties, subject to appropriate confidentiality obligations.
International transfers of your data
Most of your data is processed within the UK. Where data is transferred outside the UK, we take steps to ensure it is protected to the same standard:
- Insly is headquartered in London and processes platform data within the EU/EEA. These transfers are covered by UK adequacy regulations.
- Wisentic is based in Sweden, within the EEA. These transfers are covered by UK adequacy regulations.
- Stripe may process data in the United States and other countries. Stripe uses UK-approved data transfer safeguards to protect your data.
- Google Analytics (Google Ireland Limited) may process pseudonymised analytics data outside the UK, including in the United States. These transfers are safeguarded under the UK-US Data Bridge (an extension of the EU-US Data Privacy Framework) or standard contractual clauses. You can opt out at any time by declining analytics cookies - see Section 9.
You can ask us for further information about any specific international transfer at any time.
How long we keep your data
We keep your data only for as long as necessary. The table below sets out our standard retention periods:
Type of data | How long we keep it |
|---|---|
Policy data (active customer) | For the life of the policy plus 7 years after expiry or cancellation - required by FCA rules and to handle any late claims or disputes |
Claims data | 7 years from the date a claim is resolved or closed |
Quote data (no purchase made) | 2 years from the date of the quote |
Financial transaction records | 7 years, as required by HMRC and FCA rules |
Complaint records | 3 years from the date the complaint is closed |
Marketing consent records | Until you withdraw consent, or 3 years from your last interaction with us, whichever is sooner |
Website analytics data | Up to 26 months (standard Google Analytics retention period) |
Sanctions screening records | 5 years from the date of the check, as required by the Money Laundering Regulations |
Where we no longer need your data, we delete or anonymise it securely. In some cases, we may retain anonymised data for statistical purposes, which cannot be used to identify you.
AI and automated decision-making in claims
We use an AI-powered claims platform to help us process claims efficiently. In the majority of straightforward cases, the platform assesses your claim automatically - checking your policy details, validating the claim against the policy terms, screening for fraud, and calculating the settlement - without manual human review at every step.
This constitutes automated decision-making within the meaning of UK data protection law, and the outcome (approving or declining a claim, or the settlement amount offered) can have a significant effect on you.
Your rights in relation to automated claims decisions
You have the right to:
- request that a qualified member of our claims team reviews any automated decision on your claim
- express your point of view and provide additional information before a final decision is made
- contest a decision you believe is wrong
To exercise any of these rights, contact us at claims@heckingood.co.uk as soon as possible after receiving a claims decision.
All automated decisions are subject to human oversight. Our Claims Manager reviews the AI system's performance regularly, monitors override rates, and has the authority to override any automated outcome.
Marketing
We will only send you marketing communications (such as information about new products, features or offers) if you have given us your consent to do so.
You can withdraw your consent at any time by:
- clicking 'unsubscribe' in any marketing email we send you
- emailing us at hello@heckingood.co.uk
Withdrawing consent does not affect the lawfulness of any processing we carried out before you withdrew it. It also does not affect communications that are part of your policy (such as renewal notices or payment confirmations) - we will still send you those, as they are necessary to administer your contract.
Cookies
Our website uses cookies - small text files stored on your device that help us operate and improve the site. Except for strictly necessary cookies, we do not set any cookie on your device until you have given your consent through the cookie banner shown when you first visit our site. You can withdraw or change your consent at any time via the cookie settings link in the footer of our website; no analytics or marketing cookies will be set until you have actively opted in. We use the following types:
Strictly necessary cookies
These are essential for the website to work. They enable you to log in, navigate the site, and use the quote and buy journey. These are set automatically and you cannot opt out of them while using our site, as the site cannot function without them.
Analytics cookies (consent required)
If you consent, we use Google Analytics to understand how visitors use our site (pages visited, time on site, referral source). This data is pseudonymous and is used to produce aggregated reports - it is not used to identify you individually. Google Analytics sets cookies including _ga and _gid, which expire after up to 2 years.
Functional cookies
These cookies remember your preferences (such as your session information) to make your experience more convenient. They include session identifiers such as PHPSESSID, which stores a temporary reference to keep you logged in between pages.
Marketing cookies (consent required)
If you have consented, we may use cookies to show you relevant content or measure the performance of our advertising. These are only set with your permission.
Managing cookies
You can control and delete cookies through your browser settings. Blocking certain cookies may affect how our site functions. You can also change your consent preferences at any time by clicking the cookie settings link on our website.
For a full list of the cookies we use and how to manage them, see our Cookie Policy at heckingood.co.uk/cookies.
Keeping your data secure
We take data security seriously. Our technical and organisational measures include:
- encryption of data in transit (SSL/TLS) and at rest
- multi-factor authentication (MFA) for staff access to systems
- role-based access controls - staff can only access the data they need to do their job
- regular data backups with secure storage
- ISO 27001 certified infrastructure (Wisentic/Azure)
- PCI DSS Level 1 payment processing (Stripe)
No system is completely secure. If you believe your account has been compromised, please contact us immediately at hello@heckingood.co.uk. We will never ask you for your password.
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours, as required by law. Where a breach is likely to result in a high risk to your rights and freedoms, we will also inform you directly without undue delay.
Your rights
Under UK data protection law, you have the following rights:
Right | What it means |
|---|---|
Right of access | You can ask us for a copy of the personal data we hold about you (a 'Subject Access Request'). We must respond within one month. |
Right to rectification | You can ask us to correct any inaccurate data we hold about you. |
Right to erasure | You can ask us to delete your data where there is no lawful reason for us to keep it. This right does not apply where we are required to retain data by law or regulation. |
Right to restriction | You can ask us to pause how we use your data - for example, while we verify a correction you have requested. |
Right to data portability | Where we process your data on the basis of your consent or a contract, you can ask us to provide your data in a portable, machine-readable format. |
Right to object | You can object to us processing your data on the basis of legitimate interests. You have an absolute right to object to processing for direct marketing purposes. |
Rights related to automated decisions | You have the right to request human review of any significant automated decision - see Section 7 for details. |
To exercise any of these rights, please contact us using the details in Section 14. We will not charge a fee for straightforward requests and will respond within one month. Where a request is complex or we receive multiple requests from you, we may extend this period by a further two months - we will tell you if this applies.
We may need to verify your identity before we can respond to a data access or deletion request.
How to complain
If you are unhappy about how we have handled your personal data, please contact us first - we would like the opportunity to put things right.
If you remain dissatisfied, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO):
- Website: www.ico.org.uk
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Complaining to the ICO does not affect your right to bring legal proceedings.
Changes to this policy
We may update this policy from time to time. We will update the date at the top of this page when we do. If the change is significant, we will notify you directly - by email if you are a current customer.
We encourage you to check this page periodically.
Contact us
If you have any questions about this policy or how we use your data, please get in touch:
- Email: hello@heckingood.co.uk
- Post: HeckinGood Limited, Jenners, Slaugham, Haywards Heath, England, RH17 6AQ
To make a Subject Access Request or exercise any of your data rights: hello@heckingood.co.uk
For complaints about data handling: hello@heckingood.co.uk