Privacy notice
We're committed to safeguarding your personal data. This notice explains what information we collect, why we use it, who we share it with and the choices and rights you have.
1. Who we are and how to contact us
In this notice, “Superscript”, “we”, “us” and “our” refer to the relevant Superscript company responsible for your personal data:
- Enro Limited provides our UK insurance broking services and international services arranged through Enro Limited. It is registered in England and Wales under company number 09265254, with Information Commissioner's Office registration ZA093999, and is authorised and regulated by the Financial Conduct Authority, firm reference number 656459. Its registered office is Level 3, 16 Eastcheap, London, EC3M 1BD, United Kingdom.
- Superscript Advisory BV provides our EEA insurance broking services. It is registered in the Netherlands under KvK 80525970 and is authorised and regulated by the Authority for the Financial Markets, registration 12047717. Its registered office is Stationsplein 45, 4th floor, 3013 AK Rotterdam, Netherlands.
The entity providing your insurance service is identified in your terms of business or other service documentation. The responsible entity depends on the service and processing concerned, not simply where you live. Where both Enro Limited and Superscript Advisory B.V. are involved, we will explain their respective responsibilities in the information provided with that service. Where another Superscript group company acts as controller for a particular service or activity, we will identify that company in the relevant customer journey or other privacy information.
Contact us if you are unsure which entity is responsible for your information, including information collected through our websites.
Contact our Privacy Team: If you have any questions about our privacy notice, please email privacy@gosuperscript.com. You can also call 0333 772 0759+31 10 8080 889 or write to the Privacy Team at the relevant registered office above.
Who this notice covers
This notice applies where we act as a controller, deciding why and how personal data is used. It covers customers, prospective customers, website visitors and individuals connected with an insurance enquiry, policy or claim, including sole traders, directors, business contacts, employees, insured persons, claimants and representatives.
Company information is personal data where it identifies an individual. Recruitment and employment have separate privacy information. UK or EU data protection law applies according to the processing concerned. Read any service-specific privacy information alongside this notice.
2. How we protect information
We use technical and organisational safeguards appropriate to the information and risks, including access restrictions, confidentiality requirements and contractual protections for service providers. These are designed to protect personal data against loss, unauthorised access, use or disclosure.
Keep your account credentials confidential and contact us if you suspect unauthorised access. Do not send payment card details or passwords by email or ordinary messaging.
3. Information we collect
The information we collect depends on your relationship with us and the insurance or service involved. We only seek information relevant to the purposes described in this notice.
Account Data: names, contact details, roles and business information; enquiry, application and renewal details; insurance requirements, quotations, policies and claims history; correspondence; and payment, premium and refund records. This term includes information where you do not have an active account or take out a policy.
Claims and supporting information: incidents, losses, people involved, supporting documents and claim progress or outcomes. Relevant health, injury or criminal-offence information receives additional protection, as explained in section 6.
Customer communications and support: this includes emails, telephone recordings, messages, complaints, feedback, and communication preferences or support needs you tell us about. Some support information may reveal a health condition or disability.
Website, device and advertising data: this includes your IP address, device and browser information, approximate location derived from technical information, referral source, pages viewed, searches, clicks and other interactions with our websites, and information about how you move through our quotation, application and checkout journeys. It may also include cookie or similar identifiers, advertising and campaign identifiers, advertising click IDs, consent and preference information, and technical identifiers derived from device, browser or network information where these are lawfully used.
Where permitted and, where required, where you have given consent, we may connect this information with Account Data, such as your contact details, whether you requested or completed a quotation, or whether you purchased a policy, to understand how our advertising performs, attribute enquiries or sales to advertising campaigns, manage advertising audiences and show more relevant advertising. Where contact details such as an email address or telephone number are converted into a hashed or otherwise protected identifier before being shared for matching purposes, we continue to treat that information as personal data where it can still be used to recognise or match an individual.
Information from other organisations and public sources: relevant information from introducers, insurers, intermediaries and service providers; sanctions-screening results; and publicly available business information.
Marketing and social-media information: this includes contact preferences, consent and opt-out records, responses to communications, social-media handles, messages, and public posts in which you tag or contact us.
4. Where we obtain information
We collect information directly through our websites, applications, renewals, calls and correspondence. We may also receive relevant information from:
- Policyholders, employers, people arranging insurance and authorised representatives.
- Insurers, underwriters, brokers, claims-service providers, banks, introducers and distribution partners.
- Payment, premium-finance, screening, business-information, analytics and advertising providers
Information from advertising platforms may include campaign identifiers, referrals, conversions and whether an identifier we supplied matched a platform user. Public sources include company registers, business websites and public social-media information. We may combine information about the same enquiry, relationship or individual for the stated purposes.
If you provide another person's information, make sure you are entitled to do so and bring this notice to their attention where appropriate. We remain responsible for providing privacy information where required. You can ask us where your information came from.
Information needed to provide a service
We will explain where information is required to obtain a quotation, arrange or administer insurance, handle a claim, process a payment or meet a legal requirement. Without necessary information, we or the insurer may be unable to proceed, or the available cover or terms may be affected. Optional marketing consent is not a condition of obtaining insurance from us.
5. Why we use information and our lawful bases
Data protection law requires a lawful basis for each use of personal data. The table below explains our principal purposes and the bases relevant to them. Where different bases are shown, the explanation identifies when each applies; they are not interchangeable permissions for the same activity.
| Purpose | Lawful basis and explanation |
|---|---|
| Responding to enquiries; assessing insurance requirements; obtaining and presenting quotations; arranging cover. | Contract: where necessary to provide our broking service to you as an individual, or take steps you request before entering into that contract. Legitimate interests: where you act for a company or another policyholder, to help that organisation or person obtain suitable insurance and communicate with the people involved. |
| Administering policies, changes, renewals, cancellations, payments and refunds; supporting claims | Contract: where necessary for our service contract with you as an individual. Legitimate interests: where needed to administer insurance and support policyholders, insured persons and claims involving other individuals. Specific regulatory obligations are addressed separately below. |
| Following up an application you have started. | Contract: where the contact is necessary to progress a quotation or service you have requested as an individual. Legitimate interests: where necessary to respond to a business enquiry made on behalf of an organisation. Promotional follow-ups are treated as marketing, not automatically as service messages. |
| Meeting insurance-distribution, tax, sanctions, record-keeping and data protection requirements; handling regulated complaints and lawful regulatory requests. | Legal obligation: where the processing is necessary to meet a requirement that applies to the relevant Superscript entity. This includes applicable financial-services rules, tax and sanctions law, and data protection legislation. |
| Detecting and preventing fraud; maintaining the security of our services; investigating suspected misuse. | Legitimate interests: protecting customers, insurers and our business against fraud, unlawful activity and security incidents. Legal obligation: where a specific law requires a check, disclosure or other action. |
| Handling enquiries and service concerns; recording calls; monitoring quality; training our team; analysing feedback and service performance. | Legitimate interests: maintaining accurate records, resolving problems, improving service quality and checking how our services perform. Where a specific legal duty applies to complaint handling or monitoring, we rely on legal obligation for that part of the activity. |
Your insurance policy is generally a contract with the insurer, not with Superscript. A contract between us and a company or partner does not, by itself, provide the contract lawful basis for using an individual’s information.
Other purposes and lawful basis
| Purpose | Lawful basis and explanation |
|---|---|
| Administering introductions and distribution partnerships; identifying referred customers and reporting on the resulting insurance arrangements. | Legitimate interests: operating and checking introduction arrangements and coordinating customer services. Where a particular activity relies on consent, we explain this and obtain it separately. |
| Sending marketing, understanding relevant customer interests and managing preferences. This includes developing, testing and using models to assess which of our services and communications may be relevant to customers. | Consent: where required for the processing or communication channel. Legitimate interests: understanding customers’ interests and promoting relevant services where applicable rules permit this without consent. We keep suppression and opt-out records to respect your choices. Advertising audience matching and associated profiling are covered separately below. |
| Personalised online advertising, re-targeting, advertising audience matching and associated advertising profiling. | Consent: We rely on consent where we use customer or prospective-customer contact information for advertising audience matching or personalised advertising through platforms such as Google and Meta. Where related cookies or other storage and access technologies are used, we obtain any consent required under applicable electronic-communications laws. We do not rely on legitimate interests for customer-list audience matching unless a separate assessment has established that this is appropriate for the particular processing. |
| Measuring advertising campaigns and attributing enquiries or purchases to advertising. | Consent: where the measurement uses advertising cookies or other storage and access technologies for which consent is required. Measurement that is part of an advertising purpose may be covered by the same advertising consent. Where statistical measurement is carried out independently of an advertising purpose and can lawfully operate without consent, including where a specific legal exception applies, we may rely on legitimate interests for associated personal-data processing where appropriate and subject to the conditions of that exception. |
| Operating, securing and improving our websites and systems. | Legitimate interests: operating secure, reliable and effective services and understanding their performance where the activity does not require consent. Consent: where required for optional analytics, personalisation or similar technologies. |
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing lawfully carried out before you withdrew consent. We will explain any effect on the relevant optional activity or service.
6. Sensitive information and criminal offence information
Health, injury and disability information is “special category” data. We may need it for insurance applications, claims or additional support. Alongside a lawful basis in section 5, we need a separate legal condition.
For UK insurance activities, this may be the insurance substantial-public-interest condition under the Data Protection Act 2018, where its requirements are met. The legal-claims condition may apply to establishing, exercising or defending claims. We seek explicit consent where appropriate, including for optional health-related support where applicable; providing information does not itself mean you consent to every use.
For EEA processing, we use a condition valid under the EU GDPR and applicable national law, such as explicit consent, legal claims or an applicable statutory condition. UK insurance conditions do not automatically apply. Relevant collection or supplementary information explains the condition used.
We process criminal allegations, proceedings and convictions only for relevant insurance, fraud-prevention or other stated purposes, with the legal authorisation and safeguards required under applicable law.
7. Automated decision-making
We use automated models to analyse personal information for profiling, which means using information about you to assess or predict aspects of your circumstances, preferences or behaviour. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.
Our lawful bases are explained in section 5. Additional protections for sensitive information are explained in section 6, and your choices about marketing and advertising are explained in section 8.
Insurers may use their own automated processes to assess applications, set premiums or handle claims. Where an insurer acts as a separate controller, its privacy notice explains these activities and your rights.
8. Marketing, cookies and similar technologies
Marketing communications
We use contact details, relevant business information, preferences and responses to send information about our services and understand what is relevant to you. We follow the rules for the country, recipient and channel concerned.
We seek consent where required. UK rules may permit marketing of our own similar services under the “soft opt-in”, where its conditions are met, or relevant communications to corporate business contacts. Sole traders and certain partnerships are not corporate subscribers for those rules. These UK permissions do not automatically apply in the EEA.
You can object to direct marketing, including related profiling, at any time. Unsubscribe in our messages or contact our Privacy Team. Necessary policy and service messages may continue.
If we collect consent for partner marketing, we identify the organisations and channels covered. These choices are separate from operational data sharing and do not determine whether you can buy insurance.
Online advertising measurement
We use cookies, pixels, scripts, tags and similar technologies to understand website use, measure campaigns and, where you have made the relevant choice, show relevant advertising. Website, quotation and purchase events may be linked with Account Data for these purposes.
Where consent is required, advertising and associated tracking operate only after you allow them. Strictly necessary technologies may operate without advertising consent where legally permitted. We record your choices through our consent-management platform.
Information may be processed through server-side or data-integration services rather than sent directly from your browser. This does not remove any consent requirement for the underlying activity. Measurement intrinsically linked to advertising may use the same advertising consent; materially different tracking or profiling requires an appropriate lawful basis and any additional consent required.
Audience matching
Where we offer customer-list audience matching, we seek your separate consent before sharing contact identifiers with the relevant advertising platform, such as Google, for matching, managing audiences, personalised advertising and campaign measurement. The consent request identifies the platforms covered. Information may include an email address or telephone number converted into a hashed or otherwise protected identifier. Hashing does not necessarily make this anonymous: we continue to treat matchable identifiers as personal data.
We do not provide health information, other special category data or criminal-offence information to advertising platforms for personalised advertising or audience matching.
Your choices
Use our cookie-preference controls to reject or change optional website tracking. Consent for this is separate from consent to use contact details for customer-list audience matching. Withdraw separately given matching consent through your marketing preferences or our Privacy Team; changing one choice does not automatically change the other unless we explain otherwise.
Refusing or withdrawing optional consent does not prevent you from obtaining insurance. We stop future processing based on withdrawn consent and, where relevant, notify providers relying on it. Withdrawal does not affect processing lawfully carried out beforehand.
Our Cookie Policy provides more detailed and current information about the cookies and similar technologies used on our websites, the organisations involved, their purposes and how long relevant cookies and identifiers last.
9. Call recording and payment information
We record telephone calls to keep a record of customer instructions and Account Data, train and monitor our team, support complaint investigations, and help prevent fraud and security incidents. Relevant purposes and lawful bases are described in section 5.
Payments and premium finance are handled through the providers used for the relevant service. Information may be required to process a payment, direct debit, refund or finance introduction. Follow the instructions provided through the relevant payment process and do not send payment card details by email or ordinary messaging.
10. Information we share with third parties
We share personal data where needed for the purposes described in this notice, using only information relevant to the purpose and applying appropriate safeguards
Insurance organisations and claims services: these include insurers, underwriters, other brokers and intermediaries, and claims-service providers involved in assessing insurance requirements, obtaining quotations, arranging or administering cover, and handling claims. They may act as separate controllers for their own processing, including underwriting or claims decisions. Relevant privacy information is provided with the service or can be obtained from us.
Introducers and distribution partners: where you access our services through a bank or other financial-services provider, insurance intermediary or business-services partner, we may exchange information needed to administer the introduction, identify referred customers, coordinate the relevant service and report on resulting insurance arrangements. This may include information identifying the customer and confirming whether insurance has been taken out. The information and precise purposes depend on the arrangement and are explained in the relevant customer journey or supplementary information, together with the partner's identity and privacy information. This operational sharing is distinct from optional partner marketing.
Other Superscript group companies: we may share relevant information with another Superscript group company where needed to provide or support our services, operate shared systems or functions, or for another purpose described in this notice. Where another group company acts as a controller for a particular activity, we will identify it in the relevant privacy information. This does not mean every Superscript group company receives customer information or acts as a controller for every activity.
Payments and premium finance: providers used for these services include Stripe for card payments, GoCardless for direct debits and Premium Credit for premium finance. We share the information needed for the relevant payment, refund, communication or finance introduction. These providers' own privacy information explains their independent processing where applicable.
Analytics, advertising and data integration providers: we use service providers and platforms to operate our consent controls, analyse website activity, manage data flows, measure advertising and run advertising campaigns. These may include Cookiebot, Segment, Stape, Google services such as Google Analytics and Google Ads, Meta, HubSpot and providers of data warehousing and related technology. Depending on the particular service, these organisations may process information on our behalf as processors or may act as separate or joint controllers for particular purposes. Where they act as a controller, their own privacy information also explains how they use personal data. We assess the role and contractual arrangements applicable to each service rather than treating every technology provider in the same way.
The requirements relating to online advertising and audience matching described in section 8 apply before we provide personal data to an advertising platform for those purposes.
Feedback providers: we may share your name and contact details with a customer review provider, including Trustpilot, to invite feedback on our services. We apply any relevant communication preferences and legal requirements to these invitations.
Professional advisers, authorities and transactions: we may disclose relevant information to our own insurers, lawyers, auditors and other advisers; regulators and ombudsman services, including the FCA, AFM, ICO and relevant EEA data protection authorities; tax authorities, courts and law-enforcement bodies where lawful and necessary; and prospective buyers or advisers where necessary for a business sale or restructuring, subject to appropriate confidentiality and data protection safeguards.
11. International transfers of personal data
Our services and suppliers may involve storage, access or processing outside the UK or EEA, including in the United States. This includes technology and advertising services. International insurance placements may require sharing with insurers, intermediaries or claims providers in the countries involved. Overseas access can itself involve a transfer.
For UK transfers, we use an applicable UK adequacy arrangement or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum to the European Commission's Standard Contractual Clauses. For EU GDPR transfers, we use an applicable European Commission adequacy decision or appropriate safeguards, such as the EU Standard Contractual Clauses. The mechanism must cover the recipient and transfer concerned.
Where contractual safeguards are used, we assess protection and apply additional measures where needed. We use a legal exception only where its particular requirements are met, not as a blanket basis for routine transfers.
Contact our Privacy Team for information about the countries where providers store or access your data, recipients involved in international insurance placements, and the relevant transfer mechanisms. You can request a copy of applicable safeguards, with confidential information or other people's information redacted where necessary.
12. Retention of personal data
We keep information for as long as necessary for the purpose for which it is held, taking account of the type of insurance, our relationship with you, applicable record-keeping requirements, complaints, potential or existing legal claims, and the rights and interests of the people concerned.
Core Account Data relating to policies taken out. We normally retain these records for seven years after confirmed account closure event. We may retain relevant records for longer where necessary to administer a policy or claim, handle a complaint or investigation, meet a legal or regulatory requirement, or establish, exercise or defend legal claims. This does not mean every item of information associated with an account is retained for the same period.
Incomplete applications. We retain personal data relating to an incomplete application for a maximum of two years from confirmed retention starting point. Information needed separately to handle a complaint, legal claim or legal or regulatory obligation may be retained for that purpose where justified, rather than as an active application.
Marketing information. Relevant contact details and preference records may be retained while there is a lawful basis for marketing. A marketing opt-in is not a reason to retain an entire abandoned application indefinitely. We keep a limited suppression record where necessary to respect an opt-out and avoid contacting you again.
Other records. Call recordings, support information, website information and other operational records are kept according to their purpose, any relevant complaint or investigation and applicable requirements. For website technologies, retention also depends on the purpose, the relevant cookie or identifier and your choices; further information is available through our Cookie Policy or Privacy Team. Special category information is not retained merely because it was originally included in an account record.
At the end of the relevant retention period, information is deleted or anonymised so that it no longer identifies an individual. Contact our Privacy Team for information about the period or criteria applicable to particular records.
13. Your individual rights
Depending on the applicable law and the circumstances, you can ask us to:
- Provide access to your personal data and information about how it is used.
- Correct inaccurate information or complete information that is incomplete.
- Erase information where there is no continuing lawful reason to keep it.
- Restrict processing, for example while a dispute about accuracy or an objection is considered.
- Provide a portable copy of information you have provided, in a structured, commonly used, machine-readable format, where processing is automated and based on consent or a contract with you; or send it to another controller where technically feasible.
You may object to processing based on legitimate interests for reasons relating to your situation. You may object to direct marketing, including related profiling, at any time without giving a reason. Where we rely on consent, you may withdraw it at any time, as described in section 8.
Some rights have conditions or exceptions, including where records are needed for legal obligations or claims. We explain when we cannot fulfil a request.
Contact our Privacy Team using section 1; no particular form is required. We may seek proportionate information to verify identity. We normally respond within one month, with up to two further months where legally permitted for complex or numerous requests; we explain any extension within the initial period. Any lawful pause to a UK access request for necessary clarification will be explained and does not automatically apply to EEA requests.
Requests are normally free. Any fee or refusal must be legally permitted; we will explain the reasons and your options.
14. Complaints
Contact our Privacy Team by email, telephone or post to raise a concern about how we handle your information. We can help you explain your concern.
We will acknowledge your complaint within 30 days, investigate it appropriately, keep you informed and explain the outcome without undue delay. This is separate from the response period for exercising a data protection right. Insurance and service complaints may also engage a separate complaints process.
You have the right to complain to a relevant data protection authority. For UK matters, this is the Information Commissioner's Office (ICO). For matters involving our Netherlands establishment, this is the Autoriteit Persoonsgegevens (AP). Under the EU GDPR, you may also complain to the authority in the EEA country where you habitually live or work, or where an alleged infringement occurred. These rights are not limited by our internal process, and you may seek a judicial remedy where available.
15. Changes to this notice
We review this notice regularly and draw material changes to your attention where appropriate. Before using your information for a new purpose, we provide relevant privacy information and obtain any required consent or other authorisation. Updating this notice does not itself authorise a new use.