Small claims service portal privacy notice compensator representatives

Introduction

The Small Claims Service has been developed as part of a package of measures introduced by the Government to reform the way low-value personal injury claims arising from road traffic accidents are processed.

In order to provide the Small Claims Service, Official Injury Claim Limited (“us”, “we” or “our”) collects certain personal data about you in your capacity as a representative of a compensator managing a claim brought through the Small Claims Service Portal. We respect your privacy and are committed to protecting your personal data. Personal data, or personal information, means any information about an individual from which that person can be identified.

This notice explains how we will process your personal information when you use the Small Claims Service in your role for a compensator. This notice also provides you with additional information regarding your privacy rights. It is important that you read this Privacy Notice so that you are fully aware of how and why we use your personal data in the context of the Small Claims Service.

Our Privacy Policy is designed to be as clear and informative as possible, but do not hesitate to let us know if you have any questions about the ways in which we use your personal information. We may amend this Privacy Notice from time to time, and will update you of any material changes.
Who is primarily responsible for your personal information?

Official Injury Claim Limited (company number 11752037, registered in England) is primarily responsible for the personal information we collect about you when you use the Small Claims Service. We are therefore termed the ‘controller’ under the General Data Protection Regulation.

Our registered office address is Linford Wood House, 6-12 Capital Drive, Milton Keynes MK14 6XT. You can also contact us via telephone on 01908 830 001 or via email at customer.service@officalinjuryclaimlimited.org.uk.

Data Protection Officer

Small Claims Service |Contact Details

Our full details are:

Full name of legal entity: Official Injury Claim Limited
Name or title of Data Protection Officer: Chief Financial Officer
Email address: customer.service@officalinjuryclaimlimited.org.uk
Postal address: Linford Wood House, 6-12 Capital Drive, Milton Keynes MK14 6XT
Telephone number: 01908 830 001

We collect personal information from and about you through:

Direct interactions. When you create an account on the Small Claims Service Portal, you provide us with your name and professional email address.

Automated technologies or interactions. As you interact with the website that hosts the Small Claims Service Portal, we automatically collect information about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive technical data (such as your IP address and information about your browser) if you visit websites employing our cookies. Please see our Cookie Policy for further details.

How we use your personal data and how long we keep it for

We will only use your personal data when the law allows it and only to the extent necessary in order to fulfil the purpose for which we need to collect it. Below we set out these purposes, the lawful basis we rely on in order to do so, and how long we keep your personal information for.

Purpose for which we use your personal data	What type of personal data are we using?	What lawful basis do we rely on to use your personal data?	How long do we retain your personal data?
To enable you to create and use an account on the Small Claims Service Portal, so you can respond to claims.	Name Professional email address and telephone number	We rely on our legitimate interest in registering and maintaining your user account, and enabling your employer to use the Small Claims Service Portal to review claims from its policyholders. Our legitimate interest is the proper functioning of the Small Claims Service Portal.	We will generally only retain your personal information while you are registered on our system and your organisation has not alerted us to the fact that you are no longer employed there (unless you are self-employed). If your organisation’s account is terminated early as a result of a breach of the terms governing its use of the Small Claims Service Portal, your organisation’s information (including your information) will be retained for 6 years. If your organisation’s account is inactive for 12 months, it will be deleted at that point (along with any of your information included in that account).
To contact you if there are any problems with your account.	Name Professional email address and telephone number	We rely on our legitimate interests in ensuring that your account, and the Small Claims Service Portal, function as required. Our legitimate interest is the proper functioning of the Small Claims Service Portal.	We will generally only retain your personal information while you are registered on our system and your organisation has not alerted us to the fact that you are no longer employed there (unless you are self-employed). If your organisation’s account is terminated early as a result of a breach of the terms governing its use of the Small Claims Service Portal, your organisation’s information (including your information) will be retained for 6 years. If your organisation’s account is inactive for 12 months, it will be deleted at that point (along with any of your information included in that account).
To share your information with third parties such as the claimants and in some cases their professional advisors who use the Small Claims Service Portal and our third party service providers (such as our cloud service provider).	Name Professional email address and telephone number	We rely on our legitimate interests in ensuring that Small Claims Service operates as intended and so that your account, and the Small Claims Service Portal, function as required. Our legitimate interest is the proper functioning of the Small Claims Service Portal.	We will generally only retain your personal information while you are registered on our system and your organisation has not alerted us to the fact that you are no longer employed there (unless you are self-employed). If your organisation’s account is terminated early as a result of a breach of the terms governing its use of the Small Claims Service Portal, your organisation’s information (including your information) will be retained for 6 years. If your organisation’s account is inactive for 12 months, it will be deleted at that point (along with any of your information included in that account).
To administer the Small Claims Service website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes.	[Note: MIB to confirm whether IP addresses are collected, and which personal data is used for administering the website.]	We rely on our legitimate interests in ensuring the Small Claims Service Portal continues to function effectively and enables claimants, and professional users, to submit and receive responses to claims. Our legitimate interest is the proper functioning of the Small Claims Service Portal.	We will keep this information up to 6 years.

In some circumstances you can ask us to delete your data: see “Right to erasure” below for further information.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

Change of purpose

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so. However, we may process your personal data without your knowledge or consent where this is required or permitted by law.

Other parties who will have access to your data

Your personal data may be disclosed by us to the following third parties within the United Kingdom and overseas:

other companies in our group of companies, for internal reporting purposes;

the relevant claimants who submit claims through the Small Claims Service Portal and their professional advisors if the claimants receive assistance;
third parties which provide technical services to us in the context of the Small Claims Service which enable us to provide the Small Claims Service Portal, including Okta, Pega, and Experian;

other service providers including IT suppliers and administration services providers;other public bodies, including regulatory bodies, where we are obliged or permitted by law to do so (this may include the General Medical Council and the Information Commissioner’s Office); and

our professional advisors including auditors.

We may also disclose your personal data to third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then our new owners may use your personal data in the same way as set out in this Data Protection Privacy Notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

Transferring your personal information overseas

Your personal data will generally not be transferred outside the European Economic Area (“EEA”) or the UK (after the end of the Brexit transition period) other than where the transfer is necessary for the purposes of establishing, exercising or defending legal rights, obtaining legal advice, or in connection with any legal proceedings, or otherwise as permitted by law.

If we ever do transfer your personal data outside the EEA (or the UK once the Brexit transition period has ended), we will take appropriate steps to protect your information, including:

entering into agreements with third parties which include the “Standard Contractual Clauses”, being clauses the European Commission (or the equivalent UK body once the Brexit transition period has ended) has determined offer adequate protection for your information;

only transferring information to organisations within countries that the European Commission and/or the UK (depending on the circumstances) has judged offers adequate protection for your information.

Data security

We have put in place appropriate security measures to prevent your personal data from being lost, used, accessed, altered or disclosed in an accidental or unauthorised way. We are committed to ensuring that all reasonable and appropriate steps have been taken to protect your personal data which incudes, where appropriate, utilizing encryption measures.

We have also put in place procedures to deal with any suspected personal data breach and will notify you and any relevant regulator of a breach where we are legally required to do so.

Your data protection rights

Under certain circumstances, you have a number of rights under data protection laws with regard to the personal data we use about you. These are described in the sections below. To exercise any of your rights in relation to the Small Claims Service, please contact the Data Protection Officer:

via email at customer.service@officialinjuryclaim.org.uk
or by post: DSAR, Official Injury Claim Limited, Linford Wood House, 6-12 Capital Drive, Milton Keynes, MK14 6XT

Right of access to personal data - You have a right to request a copy of the personal data we hold about you.

Right to rectification - If you believe the personal data we hold about you is incorrect, you can contact us to request for any incomplete or inaccurate data that we hold about you to be corrected. However, we may need to verify the accuracy of the new information you provide to us.

You can amend inaccurate contact details on your registered account with us at any time by logging into your account here.

Right to erasure - You have the right to request the deletion or removal of personal data we hold about you where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to us holding your information, where we may have processed your information unlawfully or where we are required to erase your personal data to comply with law. Although we will consider every request for erasure on its merits, we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at that time of your request.

Right to object to processing - You have a right to object to the processing of your personal data where we are using it for the purpose of our legitimate interests. If we agree that your objection is justified we will stop using your information for those purposes. Alternatively, we will explain why we still need to use your information.

Right to restrict processing of your personal data - You have a right to request us to suspend the processing of your personal data in the following situations:

for the period it takes us to rectify any inaccurate data about you;

where our use of the data is unlawful but you do not want us to erase it;

where you want to prevent us from deleting your data at the end of the retention period in the event that you need it to establish, exercise or defend a legal claim;

where you have objected to our use of your data, but we need to verify whether we (or a third party) have overriding legitimate grounds to use it.

Right to request the transfer of your personal data to you or to a third party – You have the right to ask us to transfer certain information we hold about you to a third party you have chosen, or directly to you. Where your request is valid, we will provide you with your personal data in a structured, commonly used, machine-readable format.

Right to lodge a complaint

If you have any complaints about how the we handle your personal data, please contact us by telephone on 01908 830 001, or by email at customer.service@officialinjuryclaim.org.uk and we will do our best to assist.

You also have a right to make a complaint to the supervisory authority in your country of residence or employment or place of the alleged infringement. The Information Commissioner’s Office (“ICO”) is the UK supervisory authority for data protection issues. You can contact the ICO:

by Telephone: 0303 123 1113 or 01625 545 745
or in writing to: Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
or via their website: www.ico.org.uk