Skip to main content skip to search skip to contact

We believe you should always know what personal information we collect from you and how we use it, ARAG UK is committed to being open and transparent with how we use your personal information. That is the basic purpose of this Privacy Notice.

ARAG UK is committed to ensuring that your privacy is protected. Whilst providing our services we may be required to collect certain personal data from you. Should we ask you to provide personal data then you can be assured that it will only be used in accordance with this privacy statement.

This Privacy Policy was updated on 25 November 2024.

 

Data Controller

This Privacy Notice is issued by ARAG UK (collectively referred to as “ARAG”, “we,” “us” and “our” in this Privacy Notice) that operate in the United Kingdom.

For the purpose of the UK General Data Protection Regulation, the following entitles are part of ARAG UK and can act as data controllers of your personal information:

Entity
ICO Registration Number
ARAG Legal Expenses Insurance Company Limited Z5929870
ARAG plc Z9365535
ARAG UK Holdings Limited Z5930219

The registered office for all our legal entities is Unit 4, Greenway Court, Bedwas, Caerphilly, CF83 8DW.

Typically, ARAG UK entities act as Data Controllers which means we are responsible for ensuring that your information is collected, processed, secured, and retained in accordance with applicable data protection laws.

What we need

Whilst providing our services we may require personal data. Personal data is information about you from which you can be identified such as your name and contact details. Depending on what services you receive from us, this may include sensitive personal data such as medical information. We will not collect any personal data from you that we do not need to provide our service to you.

The personal information you have provided, or we have received from third parties typically includes:

Type of personal information
Description
Personal details including contact information Information that identifies or links to you as an individual such as your name, postal address, e-mail address, telephone number, date of birth or age, marital status, gender identification, national insurance number, vehicle registration number and driving licence details.
Financial Financial details for the purposes of processing payments and transactions, this may include your card details, and / or account information.
Special Category Data (sensitive information) We may collect sensitive information such as:
  • Information revealing racial or ethnic origin.
  • Biometric data (where used for identification purposes or call recordings).
  • Health information (for example, if you wish to pursue a personal injury claim, we will require details of any injuries you may have sustained and may require medical records.)
  • Information collected in order to make reasonable adjustments as a result of a vulnerability, this may include information related to your physical and mental health.
Criminal offence data We may collect information related to any:
  • Criminal activity.
  • Allegations.
  • Investigations and
  • Proceedings.
For example, motor convictions, or information that will help us to prevent or detect crime (including fraud).

We will either collect information directly from you, from someone who has authority to make a claim on your behalf, or your general insurer or broker (who sold you your policy) when:

  • You purchase an ARAG product.
  • You use your policy, such as making a claim or using one of our helplines and discussing your claim with us as it progresses.
  • You make enquiries or a complaint.
  • You use our website.
  • You communicate with us by telephone, in writing by post or email, or via online channels.
  • We audit your claim that is being handled by a third party
  • Your insurer/broker/solicitor provides us with details of your policy purchase

We collect information through “Cookies” when you use our website, we use them to analyse how you use our website, to allow us to provide optimised content and to help us provide a better overall browsing experience. To find out more about Cookies please read our separate Cookie Policy.

How we use your information

If you are an ARAG employee, former employee, or a prospective employee, please refer to the Employee Privacy Notice or contact (external).

We will use your information to:

What we use your personal information for
Type of Information collected
Our Reasons
Manage your policy
  • Personal details such as
  • – Identity
  • – Contact
  • Performance of a contract with you
  • Necessary for our legitimate interests
Manage your claim, including providing updates and to make decisions relating to policy coverage
  • Personal details such as:
  • – Identity
  • – Contact
  • Biometric (voice on call recording)
  • Special Category data (sensitive information)
  • Financial
  • Transaction
  • Performance of a contract with you
  • Necessary for our legitimate interests (to progress the claim and for quality and assurance monitoring)
  • For establishing, exercising, or defending any legal claims in relation to your policy.
  • For insurance purposes.

Provide you with the services outlined in your policy (this may include sharing information with third party service providers)
  • Personal details such as:
  • – Identity
  • – Contact
  • Biometric (voice on call recording)
  • Performance of a contract with you
  • Necessary for our legitimate interests
  • For establishing, exercising, or defending any legal claims in relation to your policy.
Process the data of parties involved in our Policy Holders’ & Claimants’ claims when managing the claims
  • Personal details such as:
  • – Identity
  • – Contact
  • Special Category data
  • Legitimate Interest - As you are involved in a legal claim with our policyholder, we have a legitimate interest in processing your data.
  • For establishing, exercising, or defending any legal claims in relation our claimant’s policy.
  • For Insurance purposes.

Handle complaints
  • Personal details such as:
  • – Identity
  • – Contact
  • Biometric (voice on call recording)
  • Special Category data
  • Performance of a contract with you
  • Necessary for our legitimate interests (to investigate and respond to complaints raised by you)
  • To comply with our legal obligations.
  • For establishing, exercising, or defending any legal claims in relation our claimant’s policy.
  • For Insurance purposes
Share with regulatory bodies, auditors, and other insurance companies (directly or via shared databases) when required by law and to prevent and detect fraud
  • Personal details such as:
  • – Identity
  • – Contact
  • In order to comply with our legal obligations.
  • Necessary for our legitimate interests
Contacting business partners & prospective business partners
  • Personal details such as:
  • – Identity
  • – Contact
  • Special Category data (criminal offences)
  • Legitimate interest – to enter into a business relationship with us.
  • Fulfilment of a contract- To fulfil our contractual obligations towards you or to take pre-contractual steps to enter a business relationship.
  • Consent – you give your consent when entering any details of criminal convictions into our agency application form.
In the event of a merger, asset sale, or other related transaction
  • Personal details such as:
  • – Identity
  • – Contact
  • Special Category data
  • Performance of a contract with you
  • In order to comply with our legal obligations.
  • Necessary for our legitimate interests
  • For establishing, exercising, or defending any legal claims in relation to your policy.
  • Insurance purposes.
Reporting and analytic purposes; Training and monitoring purposes (for example by reviewing recorded telephone calls and auditing claims); Customer satisfaction surveys.
  • Personal details such as:
  • – Identity
  • – Contact
  • Special Category data / Biometric data
  • Performance of a contract with you
  • Necessary for our legitimate interests (In order to improve our products and delivery of services to our policyholders)
  • Fulfilment of a legal obligation (complaints investigation and financial crime prevention)
  • Defence of a legal claim
  • Explicit Consent
We may indirectly /directly access your information for cyber security monitoring purposes – to ensure the protection of your personal data by monitoring cyber security threats.
  • Personal details such as:
  • – Identity
  • – Contact
  • Special Category data / Biometric data
  • Legitimate Interest
  • Defence of a legal claim
  • Detecting or preventing unlawful acts
Making Reasonable Adjustments as a result of a vulnerability, this may include information related to your physical and mental health
  • Personal details such as:
  • – Identity
  • – Contact
  • – Capability
  • – Accessibility
  • – Financial
  • – Transaction
  • – Biometric
  • Special Category data
  • – Health
  • – racial or ethnic origin
  • In order to comply with our legal obligations
  • Legitimate interest
  • Explicit consent
Sharing your personal and sensitive information in an emergency situation
  • Personal details such as:
  • – Identity
  • – Contact
  • Biometric
  • Special Category data (sensitive information)
  • Consent or explicit consent; or
  • Vital Interests (where the individual is not capable of giving consent)

Sharing data

We have put in place physical, electronic, and operational procedures intended to safeguard and secure the information we collect.
We will not disclose your personal or sensitive information for any purpose other than the purpose for which it was collected. If it is necessary to share your personal data with third party service providers, we will ensure appropriate contractual obligations are in place to protect your personal data.
We will not sell, distribute, or lease your personal information to third parties unless we have your permission or are required by law to do so.
The personal information we collect will be used by us and third parties who process information on our behalf. This may include:

  • Law firms.
  • Other companies within the ARAG Group.
  • Third party suppliers authorised to provide services on behalf of ARAG, such as hire car providers, roadside assistance services and home emergency engineers.
  • Experts for the purposes of obtaining evidence to support your claim.
  • Investigation agents and/or online tracing and investigation databases.
  • Costs draftsmen.
  • Document management services.
  • Storage within a cloud server.
  • The business partner who sold you your policy.
  • Regulators and arbitration services such as the Financial Ombudsman Service.
  • External Customer Experience agencies.
  • Where we act on behalf of, or in conjunction with another insurer/reinsurer we may share your information where it is necessary for the management of your insurance product or account.
  • Payment service providers.
  • Group or external auditors.

Transferring your information outside of the UK

Your information may be transferred outside of the UK for claims handling, processing, storage, administration, or any other use stated in this notice. The processing of any information outside the UK will comply with UK data protection laws or equivalent.

Where it is necessary to send your personal information outside of the UK steps will be taken to make sure appropriate safeguards are in place to ensure the safety and privacy of your information as set out in this privacy notice.

How long will we retain information about you

Typically, we keep your personal information for 7 years after the claim or service enquiry has been closed or completed. We will only retain and use your personal information thereafter as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. If you would like to learn more about our Data Retention and Disposal Policy, please contact us at .

Your rights

Under data protection law you may have certain rights we need to make you aware of. The rights available to you depend on our reason for processing your information. These rights are a priority to ARAG and may include:

  1. The right to be informed (about the collection and use of your personal data).

    You have the right to be informed about what personal data we hold and why. This Privacy Notice provides you with that information.
  2. The right of access (to your personal data and supplementary information, known as a Subject Access Request).

    You the right to request and receive a copy of all the personal data we hold. If you wish to do this, please write to us at .
  3. The right to rectification (if your personal data is inaccurate or incomplete)

    You have the right to correct inaccurate personal data and complete incomplete personal data we hold.
  4. The right to erasure (and removal of your personal data)

    You the right to request the deletion of your personal data. We will comply with this request providing there are no legal reasons why we cannot do so.
  5. The right to restrict processing (or ‘block’ the use of your personal data).

    You can request that we do not process any personal data that we hold. We will comply with this request providing there are no legal reasons why we cannot do so.
  6. The right to data portability (to obtain and reuse your personal data for your own purposes across different services)

    You can obtain and reuse your personal data for your own purposes across different services which we provide.
  7. The right to object (to the processing of your personal data in certain circumstances).

    You have the right to object to your personal data being processed for a legitimate interest such as direct marketing or for statistics.
  8. Rights in relation to automated decision making and profiling.

    You have the right to object to decisions based solely on computer processing and to question the decisions made about you by a computer.

If you have any questions regarding your rights, please email .

Please note that that there are times when we will not be able to honour your request regarding your personal data. This may be due to us requiring that data to fulfil our legal or regulatory duties or where there is a minimum, statutory period for which we must keep your information. If we are unable honour your request, we will let you know our reasons.

Right to withdraw consent

Where we have obtained your consent to process certain types of personal information or sensitive information, you do have the right to withdraw this consent at any time. You can make this request by contacting our claims department at claims@arag.co.uk (please quote your reference number if available) or the data protection department .

Please note, these rights are not absolute and there may be times when we cannot do what you ask us to. If that is the case, we will explain why when we reply to you. If you have a question about this Privacy Notice, how we use your personal information, or if you are not happy with how we process your information, please contact the Data Protection Officer at: dataprotection@arag.co.uk or writing to:

Data Protection Officer
ARAG UK
Unit 4
Greenway Court
Bedwas
Caerphilly
CF83 8DW

If you would like to access your personal information, you can request this by using our data request form.

How to make a complaint

If you wish to complain about how we have handled your personal data, or you have any questions/concerns about the way we process your personal information please contact us by emailing: or writing to:

Data Protection Officer
ARAG UK
Unit 4
Greenway Court
Bedwas
Caerphilly
CF83 8DW

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law, you can complain to the Information Commissioner’s Office (ICO). You can contact the Information Commissioner’s Office by visiting ico.org.uk, by telephone at 0303 123 1113 or by post to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Updating this privacy notice

ARAG may change this policy from time to time by updating this page. You should check this page from time to time to ensure that you are happy with any changes.