Call Us 01242 808740
Get a quote

Privacy Notice

Kingsbridge Contractor Insurance – Data Protection Notice

Last Updated: September 2026

1. Introduction and scope

This data protection notice (this “Notice“) describes how Kingsbridge Risk Solutions Limited t/a Kingsbridge Contractor Insurance (“Kingsbridge“) collects, handles, secures, shares and uses the personal data of users visiting Kingsbridge’s websites and online applications, including the Kingsbridge IR35 Status Tool available at kingsbridge.ir35.io, and the personal data of individuals in relation to other interactions, transactions, sites or applications that reference this Notice, or who provide their personal data to Kingsbridge through other channels (such as by phone or email), such users and individuals being “Data Subjects“.

This Notice applies only to the personal data of Data Subjects who are resident in the United Kingdom (UK) or the European Economic Area (EEA).

We shall act as a controller of Data Subjects’ personal data that is collected or received in accordance with this Notice.

To receive this Notice in another format (for example, audio, large print or braille), please contact Kingsbridge using the contact details in section 12 (How to contact Kingsbridge) below.

2. What personal data does Kingsbridge process and how is it collected?

User provided personal data

Data Subjects may provide the following types of personal data to Kingsbridge (whether by uploading, through Kingsbridge’s websites or online applications, email, telephone, post or otherwise) which may then be collected, used, stored and transferred in accordance with this Notice:

Contact Data

  • Physical address(es)
  • Email address
  • Telephone numbers

Identity Data

  • First name
  • Last name
  • Username or similar identifier
  • Title
  • Date of birth
  • Gender

Financial Data

  • Bank account
  • Payment card details

Profile Data

  • Username and password
  • Purchases or orders made
  • Interests
  • Preferences
  • Feedback
  • Survey responses

Transaction Data

  • Details about payments to and from Data Subjects
  • Purchases made

Marketing and Communications Data

  • Preferences in receiving marketing from Kingsbridge and its third parties
  • Communication preferences

IR35 Status Assessment Data

Where the Kingsbridge IR35 Status Tool is used, Kingsbridge may process information relating to an IR35 status assessment, including:

  • Responses provided during an IR35 assessment
  • Information about an engagement and associated working practices
  • Supporting information submitted in connection with an assessment
  • Assessment outcomes
  • Assessment history
  • Associated records relating to the assessment

The precise information collected will depend on the nature of the assessment and the information provided by the relevant individuals or organisations.

Automatically collected personal data

The following types of personal data may be automatically logged when Data Subjects access and use Kingsbridge’s websites or online applications, including the Kingsbridge IR35 Status Tool, or otherwise interact with us, which Kingsbridge may then collect, use, store and transfer in accordance with this Notice:

Technical Data

  • Cookies and similar technologies – see section 5 (Cookies)
  • Internet protocol (IP) address
  • Login data
  • Browser type and version
  • Time zone setting and location
  • Browser plug-in types and versions
  • Operating system and platform
  • Other technology on the devices used to access Kingsbridge’s websites or online applications

Usage Data

Information about how Kingsbridge’s websites and online applications are used.

Third party provided personal data

Kingsbridge may also obtain Data Subjects’ personal data from the following third parties:

Recruitment agencies

Kingsbridge may receive Contact Data and Identity Data through general correspondence (including emails), contracts and referrals.

Accountancy firms

Kingsbridge may receive Contact Data and Identity Data through general correspondence (including emails), contracts and referrals.

Customers and organisations using the IR35 Status Tool

Where appropriate, Kingsbridge may receive Identity Data, Contact Data and information required to undertake or administer an IR35 status assessment from a recruiter, end client, customer organisation or other authorised party.

Service providers

Kingsbridge may receive Contact Data, Identity Data and other relevant information through general correspondence (including emails), contracts, purchase orders, financial or bank transfer information, tax or regulatory documents, fraud prevention tools, marketing lists and other services provided to Kingsbridge.

Data provided via WhatsApp

If Data Subjects choose to communicate with Kingsbridge via WhatsApp, Kingsbridge will collect the content of those communications, including any personal data provided (such as name, contact details, policy information and queries).

Please note that WhatsApp Ireland Limited (and its parent company Meta Platforms) will also process personal data in connection with such communications in accordance with its own privacy notice.

Children

Kingsbridge’s products and services are not provided to children. We do not knowingly collect personal data from children under the age of 13.

If you are a parent or guardian of a child under the age of 13 and believe they have disclosed personal data to Kingsbridge, please contact us using the contact details at section 12 (How to contact Kingsbridge) below.

A parent or guardian of a child under the age of 13 may review and request deletion of such child’s personal data as well as prohibit the use thereof.

Cookies

Please see section 5 (Cookies) below for details on how Kingsbridge uses cookies and similar technologies across its websites and online applications.

3. How does Kingsbridge use personal data?

Kingsbridge may use personal data for the following purposes:

To monitor the use of Kingsbridge’s websites and online applications

Type of personal data: Technical Data and Usage Data.

Lawful basis for processing: Legitimate interest; Consent (in relation to non-essential cookies).

Details: To improve the functionality and content of our websites and online applications.

To create and maintain an account with us

Type of personal data: Identity Data, Contact Data and Profile Data.

Lawful basis for processing: Legitimate interest; Consent.

Details: To enable Data Subjects to set up an account and to access and manage their account in accordance with its functionality. To improve the speed at which Data Subjects can purchase or access our products and services.

To provide products and services (including necessary communications other than marketing)

Type of personal data: Identity Data, Contact Data, Financial Data, Transaction Data and IR35 Status Assessment Data, where applicable.

Lawful basis for processing: Legitimate interests; Necessary to comply with a legal obligation; Performance of a contract.

Details: To enable us to provide our products and services to Data Subjects.

In relation to the Kingsbridge IR35 Status Tool, this includes administering user accounts, conducting and recording IR35 status assessments, processing information supplied as part of an assessment, generating assessment outcomes, providing results to authorised users and organisations and providing associated support.

To manage and protect Kingsbridge’s business

Type of personal data: Identity Data, Contact Data and Technical Data.

Lawful basis for processing: Legitimate interests; Necessary to comply with a legal obligation.

Details: This includes troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data. To manage Kingsbridge’s business and ensure the effective operation of Kingsbridge’s websites, online applications, products and services. To prevent fraud.

To undertake identification verification

Type of personal data: Identity Data and Contact Data.

Lawful basis for processing: Legitimate interests; Necessary to comply with a legal obligation.

Details: To prevent fraud.

To use data analytics to improve Kingsbridge’s websites, online applications, products and services

Type of personal data: Technical Data and Usage Data.

Lawful basis for processing: Legitimate interests.

Details: To keep Kingsbridge’s websites and online applications updated and relevant. To develop Kingsbridge’s business and inform Kingsbridge’s marketing strategy.

To contact Data Subjects who request such contact

Type of personal data: Identity Data and Contact Data.

Lawful basis for processing: Consent.

Details: To respond to Data Subjects’ contact requests.

To send personal marketing and promotional materials to Data Subjects as individuals

Type of personal data: Identity Data, Contact Data and Marketing and Communications Data.

Lawful basis for processing: Consent.

Details: To promote Kingsbridge’s products and services.

To send marketing and promotional materials to Data Subjects in a business context

Type of personal data: Identity Data, Contact Data and Marketing and Communications Data.

Lawful basis for processing: Legitimate interests.

Details: To promote Kingsbridge’s products and services.

To enable Data Subjects to complete a survey

Type of personal data: Identity Data, Contact Data, Profile Data and Usage Data.

Lawful basis for processing: Consent.

Details: To obtain feedback from Data Subjects on our websites, products and services so that we can make improvements to them.

Kingsbridge may process Data Subjects’ personal data under more than one lawful basis depending on the specific purpose for which Kingsbridge is using the personal data.

If a Data Subject has provided consent to processing and subsequently withdraws that consent, Kingsbridge may still process that Data Subject’s personal data where Kingsbridge has another lawful basis for doing so, provided that the Data Subject has not expressly asked us to stop processing their personal data in accordance with section 10 (Legal Rights) below.

Where more than one lawful basis has been set out above, Data Subjects should contact Kingsbridge if they need details about the specific lawful basis that Kingsbridge is relying on to process their personal data.

Where Kingsbridge needs to collect personal data by law or under the terms of a contract that Kingsbridge has with a Data Subject and the Data Subject fails to provide that personal data when requested, Kingsbridge may not be able to perform the contract it has with the Data Subject.

4. Sharing of personal data

Kingsbridge may share Data Subjects’ personal data with the following categories of third parties:

Service providers

Kingsbridge’s service providers include third parties that provide Kingsbridge with services such as IT services, hosting services, administration services and other business process services. Such third parties will act as Kingsbridge’s processors.

Professional advisers

Kingsbridge may need to provide Data Subjects’ personal data to its professional advisers that provide services to Kingsbridge. Kingsbridge’s professional advisers include lawyers, accountants, bankers, auditors and insurers.

Such third parties may act as Kingsbridge’s processors or independent controllers.

Authorities

Kingsbridge may disclose personal data where required in order to respond to requests from regulatory or governmental authorities (such as the Financial Conduct Authority), court orders, legal process, or to establish or exercise our legal rights or defend against legal claims.

It may also be necessary for Kingsbridge to share personal data in order to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, or as otherwise required by law.

In such circumstances, Kingsbridge will take appropriate measures to ensure that the recipient understands the sensitive nature of the personal data that they may receive.

Group companies

Kingsbridge may share Data Subjects’ personal data with its group companies and, in such circumstances, will ensure that all necessary protections are put in place as required by applicable law.

Other third parties

Kingsbridge may share Data Subjects’ personal data with third parties with whom we may choose to transact business.

Kingsbridge may share Data Subjects’ personal data with third parties to whom it may choose to sell, transfer or merge parts of its business or its assets (including in relation to restructuring or insolvency situations).

Alternatively, Kingsbridge may seek to acquire other businesses or merge with them. If a change happens to Kingsbridge’s business, then the new owners may use Data Subjects’ personal data in the same way as set out in this Notice.

Data Subjects’ personal data may be a transferred asset in any sale of all or part of Kingsbridge’s business.

Kingsbridge has relationships with a number of accountancy firms, recruitment companies and trade and professional associations.

If a Data Subject were referred to Kingsbridge by one of these organisations, with whom they are associated and with whom Kingsbridge has an agreement, Kingsbridge may share with them the status of a Data Subject’s policy and relevant information the Data Subject will have supplied to Kingsbridge during the insurance purchasing process as well as provide a copy of the Data Subject’s policy schedule.

Where an IR35 status review has been completed through the Kingsbridge IR35 Status Tool, Kingsbridge may share the relevant assessment outcome and associated information with the relevant recruiter or other authorised recipient, where appropriate and in accordance with the applicable arrangements.

If Data Subjects were referred by a third party, Kingsbridge may also share details with the Data Subject’s recruitment agency.

Kingsbridge shares such information on the grounds of its, and such third parties’, legitimate interests in operating its and their respective businesses and providing its and their respective products and services.

Kingsbridge requires all its data processors and any other third party that Kingsbridge provides Data Subjects’ personal data to respect the security of Data Subjects’ personal data and to treat it in accordance with applicable law.

Kingsbridge does not allow its data processors to use Data Subjects’ personal data for their own purposes and only permits them to process Data Subjects’ personal data for specified purposes and in accordance with Kingsbridge’s instructions.

5. Cookies

Kingsbridge’s websites and online applications, including the Kingsbridge IR35 Status Tool, use cookies and similar technologies.

Please see the Kingsbridge Cookie Policy, which provides details of the technologies used across Kingsbridge’s websites and online services, the purposes for which they are used and how users can manage their preferences where applicable.

6. Marketing

Data Subjects may receive marketing communications from Kingsbridge if they have requested such communications from Kingsbridge or, where permitted by applicable law, if they have purchased goods or services from Kingsbridge and they have not opted out of receiving future marketing communications.

Third party marketing companies

Kingsbridge will obtain Data Subjects’ explicit consent before it shares their personal data with any company outside of Kingsbridge’s group of companies for marketing purposes.

Opt-out

If a Data Subject does not wish to receive marketing information from Kingsbridge, the Data Subject can opt out by contacting Kingsbridge using the contact details at section 12 (How to contact Kingsbridge) below or by clicking the opt-out link in Kingsbridge’s electronic marketing communications.

7. International transfers

Data Subjects’ personal data collected by Kingsbridge in the UK or the EEA may be transferred outside of the UK or the EEA (as applicable) to those third parties specified in section 4 (Sharing of Personal Data) above.

However, in such circumstances, to the extent Kingsbridge is required to do so under applicable law, Kingsbridge will ensure contractual or other measures that have been adopted or approved by the UK Government or the European Commission (as applicable) are taken, such as ensuring applicable standard contractual clauses are in place.

Data Subjects can obtain more information about the countries to which their personal data is transferred and copies of the additional measures put in place by contacting Kingsbridge using the contact details at section 12 (How to contact Kingsbridge) below.

8. Security of personal data

Kingsbridge maintains appropriate physical, technical, administrative and organisational security measures to protect personal data from loss, misuse and unauthorised access, disclosure, alteration and destruction, including, where appropriate:

  • The pseudonymisation and encryption of personal data
  • The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services
  • The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
  • A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing

All of Kingsbridge’s employees, contractors and data processors who have access to, and are associated with, the processing of personal data are obligated to keep the personal data confidential and not use it for any other purpose than to carry out the services they are performing for Kingsbridge.

While Kingsbridge will use all reasonable efforts to safeguard Data Subjects’ personal data, the use of the internet is not entirely secure and for this reason Kingsbridge cannot guarantee the security or integrity of any personal data that is transferred from Data Subjects or to Data Subjects via the internet.

9. Retention of personal data

Kingsbridge will only retain Data Subjects’ personal data for as long as necessary to fulfil the purposes Kingsbridge collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.

To determine the appropriate retention period for personal data, Kingsbridge considers the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of the personal data, the purposes for which Kingsbridge processes the personal data and whether Kingsbridge can achieve those purposes through other means, and the applicable legal requirements.

Details of retention periods for personal data are available from Kingsbridge on request using the contact details at section 12 (How to contact Kingsbridge) below.

We may anonymise Data Subjects’ personal data so that it can no longer be associated with the Data Subject and is no longer classed as personal data. In such circumstances we may use such information without further notice to the Data Subject.

10. Legal rights

Data Subjects may have the following rights under applicable data protection laws in relation to their personal data:

Request access to the Data Subject’s personal data

This enables the Data Subject to receive a copy of their personal data that Kingsbridge holds and to check that Kingsbridge is lawfully processing it.

Request correction of the personal data that Kingsbridge holds about the Data Subject

The Data Subject can require Kingsbridge to correct any mistakes in the Data Subject’s personal data free of charge.

The Data Subject must provide Kingsbridge with enough information to identify the Data Subject (e.g. account number, username, registration details) and let Kingsbridge know the information that is incorrect and what it should be replaced with.

Request erasure / the right to be forgotten

This enables the Data Subject to ask Kingsbridge to delete or remove the Data Subject’s personal data where there is no permitted reason for Kingsbridge continuing to process it.

The Data Subject can ask Kingsbridge to erase the Data Subject’s personal data where:

  • The Data Subject does not believe that Kingsbridge needs the personal data in order to process it for the purposes set out in this Notice
  • The Data Subject has given Kingsbridge consent to process the personal data, subsequently withdraws that consent and Kingsbridge cannot otherwise legally process it
  • The Data Subject objects to Kingsbridge processing and Kingsbridge does not have any legitimate interests that mean it can continue to process the personal data
  • The personal data has been processed unlawfully or has not been erased when it should have been

Object to processing

The Data Subject has the right to object where Kingsbridge is relying on a legitimate interest (or those of a third party) and the Data Subject feels the processing of their personal data impacts on their fundamental rights and freedoms.

The Data Subject also has the right to object where Kingsbridge is processing personal data for direct marketing purposes.

In some cases, Kingsbridge may demonstrate that Kingsbridge has compelling legitimate grounds to process the Data Subject’s personal data which override the Data Subject’s rights and freedoms.

Request restriction of processing

This enables the Data Subject to ask Kingsbridge to suspend the processing of personal data in certain circumstances, including:

  • If the Data Subject wants Kingsbridge to establish the accuracy of the personal data
  • Where Kingsbridge’s use of the personal data is unlawful but the Data Subject does not want Kingsbridge to erase it
  • Where the Data Subject needs Kingsbridge to hold the personal data even if Kingsbridge no longer requires it because the Data Subject needs it to establish, exercise or defend legal claims
  • The Data Subject has objected to Kingsbridge’s use of the personal data but Kingsbridge needs to verify whether it has overriding legitimate grounds to use it

Request transfer of personal data

The Data Subject can require Kingsbridge to provide to the Data Subject, or a third party the Data Subject has chosen, the Data Subject’s personal data in a structured, commonly used, machine-readable format.

This right only applies to automated personal data that the Data Subject initially provided consent for Kingsbridge to use or where Kingsbridge used the personal data to perform a contract with the Data Subject.

Withdraw consent

Where Kingsbridge relies on consent to process personal data, the Data Subject may withdraw that consent at any time.

This will not affect the lawfulness of any processing carried out before the Data Subject withdraws consent.

If the Data Subject withdraws consent, Kingsbridge may not be able to provide access to the relevant Kingsbridge online service or certain functionalities. Kingsbridge will advise the Data Subject if this is the case at the time consent is withdrawn.

Exercising these rights

To exercise any of the rights set out above, please contact Kingsbridge using the contact details provided in section 12 (How to contact Kingsbridge) below.

Kingsbridge will respond to any rights that a Data Subject wants to exercise within one month of receiving the request, unless the request is complex, in which case it may take longer.

Kingsbridge may need to request specific information from a Data Subject to help it confirm that Data Subject’s identity and their right to access personal data or exercise any other rights.

This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

Please be aware that there are exceptions and exemptions that apply to some of the rights, which Kingsbridge will apply in accordance with applicable data protection laws.

Complaints

In addition to the above rights, Data Subjects have the right to lodge a complaint with a supervisory authority.

Personal data obtained by Kingsbridge from third parties

Data Subjects should review the privacy notice provided by the applicable third party or contact that third party for details about what rights the Data Subject has in respect of the personal data processed by that third party and how to exercise them.

No contract

This Notice does not form a contract between Data Subjects and Kingsbridge.

11. Financial Conduct Authority

Kingsbridge Risk Solutions Limited is authorised and regulated by the Financial Conduct Authority.

FCA firm reference number: 309149.

12. How to contact Kingsbridge

To ask any questions regarding this Notice or to exercise any rights, please contact the Kingsbridge Data Privacy Officer using the following contact details:

Address:
9 Miller Court
Tewkesbury
Gloucestershire
GL20 8DN

Telephone: 01242 808740

Email: info@kingsbridge.co.uk

13. Amendments to this Notice

Kingsbridge reserves the right to change, modify, add or remove portions of this Notice from time to time and in its sole discretion but will update Data Subjects that changes have been made by indicating on this Notice the date it was last updated.