Contact State Prospect Information Notice

This document was last updated on 02/06/2021.

We are Contact State Ltd. We work with insurance and finance providers and their intermediary partners (together called 'providers' in this notice) and the operators of websites on which people register to hear more about those providers' products and services, including getting quotes (called 'marketing sites' in this document). We collect data from marketing sites and providers, and use it for two distinct purposes, set out below.

Checking leads and routing them on behalf of marketing sites and providers

Marketing sites and providers use our Contact State platform as a way to validate contact details you submit on marketing sites, and to manage the flow of sales lead information between them. When we provide that service to them, we process your data in its 'raw' unencrypted form. We don't use that raw data for our own purposes – we use it only to provide a service to our customers. In the language of data protection laws, our customers are the 'data controllers' of that raw data. We as their service provider are the 'data processor' of the provider or the marketing site respectively. The way the marketing site uses your raw data should be set out in their privacy notice, privacy policy or similar document notified to you when you submit your details to them. The way the provider uses your data should be notified to you by the provider when they contact you, or soon after they receive your details from the marketing site. The rest of this notice doesn't apply to this service we provide to our marketing site and provider customers. It only applies to the processing we undertake for the purposes of certifying leads for our own business purposes.

Certifying leads

The second use we make of your data is to create and maintain a 'certificate' to indicate to providers the likelihood that your request has been submitted by a 'real' human from a real website and not a robot, or automated quote request generator. We add a certificate about your request to our store of certificates about others making similar requests through marketing sites. We review your request for certification purposes by examining a 'browser fingerprint' associated with your quote or contact request you make through the marketing site – see the section immediately below which describes this fingerprint. We retain that de-identified data and use it to help verify requests for info from a range of different providers and marketing sites. When we say 'de-identified', we mean that the text in it is encrypted and does not contain any information about you as a person. We don't retain your name, contacts details, or anything else that could reasonably identify you in the 'real world'.

Even though we don't process for our own purposes any data that could identify you as an individual, we take your privacy very seriously and take steps to protect it. Please read this privacy policy carefully as it contains important information on who we are and how and why we collect, store, use and share your de-identified personal information. It also explains your rights in relation to your personal information and how to contact us or supervisory authorities in the event you have a complaint.

We collect, use and are responsible for certain personal information about you. When we do so we are subject to the Data Protection Act 2018, which applies across the United Kingdom and we are responsible as 'controller' of that personal information for the purposes of those laws.

Personal information we collect about you for our own purposes

We may collect and use the following personal information about you for our own purposes.

We generate a fingerprint which is derived from your IP address and browser settings, including your browser user agent, browser plugins, device, mouse and keyboard movement and screen dimensions.

We capture referrer data available to the browser which may include your path through the marketing site.

We capture an irreversible "one way" SHA256 hash of the form data submitted on the marketing site so that we can look for patterns in submitted data. At no point in time do we capture plain text form data for our own use, and because of the nature of cryptographic hash functions, the transformation cannot be reversed to reveal the plain text.

How your personal information is collected for our own purposes

We collect this personal information direct from the marketing site on which you entered your details. We only collect this information when the "submit" button is clicked and you have consented to this notice.

How and why we use your personal information for our own purposes

Under data protection law, we can only use your personal information if we have a proper reason for doing so. In our case, the legal basis for processing your personal data is that it is necessary for the legitimate interest of us, you, providers and marketing sites. A "legitimate interest" is when there is a good business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. Providers have a legitimate interest in establishing that requests for info on their finance or insurance products are from a real person, not a robot. Marketing sites have a legitimate interest in assuring providers that this is the case. We have a legitimate interest in helping providers and marketing sites achieve those aims, and in doing so carrying out our own business of providing services to providers and marketing sites confirming that people requesting info from them are indeed 'real' potential customers, not robots.

We will never seek to establish your identity from the encrypted data we hold about you. We will never use for our own purposes the 'raw' unencrypted data we process on behalf of our provider and marketing site customers.

We will never be able to, or seek to, send you anything because we do not retain your contact details for our own purposes.

We will never provide the de-identified data we have about you for use by any person other than providers and marketing sites, and people acting on their behalf, if they ask us to.

Who we share your personal information with for our own purposes

We share your de-identified personal information with marketing sites, and the providers who pay for our service.

We store your personal information with the following service providers:

Heroku (a Salesforce company) based in the USA. Heroku is a platform we use to configure and operate Contact State. You can find our more about Heroku's GDPR compliance here - https://devcenter.heroku.com/articles/gdpr

New Relic (a US company) helps us log information about the use and performance of our Contact State platform. You can learn more about New Relic's minimal personal data processing here - https://newrelic.com/content/dam/new-relic/resources/white-papers/2019_GDPR_FAQ.pdf.

Amazon Web Services (also a US company) operates the servers on which our Contact State platform is hosted. Find out more about their data protection compliance here - https://aws.amazon.com/compliance/gdpr-center/.

We impose contractual obligations on our hosting provider to ensure they can only use your personal information to provide services to us. We may also share personal information with external auditors, and with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.

We may also need to share some personal information with other parties, such as potential buyers of some or all of our business or during a re-structuring. Usually, information will be de-identified but this may not always be possible. The recipient of the information will be bound by confidentiality obligations.

We will not share your personal information with any other third party.

How long your personal information will be kept

We will not retain your personal information for longer than necessary for the purposes set out in this policy. When it is no longer necessary to retain your personal information, we will delete it.

Transferring your personal information out of the EEA

It is sometimes necessary for us to share the encrypted version of the data you submit on the marketing site, and the certificate associated with it, outside the United Kingdom and European Economic Area (EEA), e.g. to a provider who is based outside the UK and EEA. This includes transfers to the service providers referred to in the "Who we share your personal information with for our own purposes" section below.

The USA and other countries outside of the UK and EEA do not have the same data protection laws as the UK and EEA. We therefore ensure that all our US providers who may process personal data on our behalf are subject to standard data protection contract clauses that have been approved by the European Commission. This is the approach we take in respect of transfers to Heroku, New Relic and Amazon Web Services. To obtain a copy of those clauses please contact us at support@contactstate.com.

Your rights

You have the following rights, which you can exercise free of charge. Remember, this applies only to the encrypted data we hold for our own purposes. If you want to exercise these rights in respect of the 'raw' unencrypted data you input into a marketing site, you will need to contact the marketing site.

If you would like to exercise any of those rights, we will need to first understand whether we have any data about you. Because we don't have any contact details or other data identifying you as an individual, we rely on marketing sites to pass on requests - they are the ones who actually have the email address which corresponds to the de-identified data we hold about you. Please make your request to the marketing site from which you made your request for provider information.

Access The right to be provided with a copy of your personal information (the right of access)
Rectification The right to require us to correct any mistakes in your personal information
To be forgotten The right to require us to delete your personal information—in certain situations
Restriction of processing The right to require us to restrict processing of your personal information—in certain circumstances, e.g. if you contest the accuracy of the data
Data portability The right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations
To object The right to object: — at any time to your personal information being processed for direct marketing (including profiling). Note that we are unable to do this in any event as we do not have any contact details for you; — in certain other situations to our continued processing of your personal information, e.g. processing carried out for the purpose of our legitimate interests.
Not to be subject to automated individual decision making The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you

For further information on each of those rights, including the circumstances in which they apply, please contact us or see the Guidance from the UK Information Commissioner's Office (ICO) on individuals' rights under the General Data Protection Regulation.

Keeping your personal information secure

Obviously, one big security measure we take is not using for our own purposes any data about you that could be used to identify you.

We also have appropriate security measures to prevent personal information from being accidentally lost, or used or accessed unlawfully. We limit access to your personal information to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you (via the marketing sites) and any applicable regulator of a suspected data security breach where we are legally required to do so.

How to complain

We hope that we can resolve any query or concern you may raise about our use of your information.

The General Data Protection Regulation also gives you right to lodge a complaint with a supervisory authority, in particular in the European Union (or European Economic Area) state where you work, normally live or where any alleged infringement of data protection laws occurred. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/concerns or telephone: 0303 123 1113.

Changes to this notice

This privacy notice was last updated on 02/06/2021.

We may change this privacy notice from time to time—when we do, we will take steps to inform you via the marketing sites.

How to contact us

Please contact us at support@contactstate.com or by post to our registered office at Salatin House, 19 Cedar Road Sutton, Surrey, United Kingdom, SM2 5DA, if you have any questions about this privacy policy or the information we hold about you.