Privacy
policy.

CRS Insurance Brokers is a trading name of CIB Group UK Ltd, a company registered in England and Wales (company no. 13360654). Our registered office is The Copper Room, Deva City Office Park, Trinity Way, Salford, M3 7BG.

We are authorised and regulated by the Financial Conduct Authority (FRN 960073). You can verify our registration at register.fca.org.uk.

For the purposes of data protection legislation, CIB Group UK Ltd is the data controller of your personal information.

We may collect the following categories of personal data when you enquire about or take out insurance through us:

— Contact details: name, address, email address, telephone number. — Business information: company name, company registration number, trade type, number of employees, turnover. — Insurance history: previous claims, existing policies, periods of uninsured activity. — Financial information: details required to arrange premium finance (where applicable). — Communications: records of calls (which are recorded), emails, and other correspondence with us.

Some of what we handle is more sensitive. Health information comes up when a type of cover depends on it, and in most injury claims. It may be about our client's employees or about other people, such as someone hurt on a client's premises or in an accident involving a client's vehicle. Information about criminal offences, including alleged ones, comes up when an insurer asks about convictions, and in claims involving theft, damage or a road accident.

We use this information only to arrange cover or to report, manage and settle a claim. We rely on the insurance condition in the Data Protection Act 2018 (Schedule 1, paragraphs 20 and 37) rather than on consent, because consent that could be withdrawn part-way through would leave a policy or a claim unworkable. Where a claim is disputed or may go to court, we also rely on the condition for establishing or defending legal claims.

You do not have to give us your information, but we cannot obtain quotations or place cover without it. A policy can also be voided if what we pass to an insurer turns out to be incomplete or inaccurate.

We use your personal data to:

— Arrange and administer insurance policies on your behalf. — Communicate with insurers, underwriters, and other parties necessary to place your cover. — Process and manage claims. — Comply with our legal and regulatory obligations, including FCA requirements. — Send you renewal reminders and information about your policy. — Improve our services.

Our lawful basis for processing is primarily the performance of a contract, or steps taken at your request before entering into one. Where we have a legal obligation to process data we rely on that. For marketing to business clients and prospects we rely on legitimate interests, being our interest in offering insurance services to businesses likely to need them. Tell us to stop and we will.

Where we hold information about people who are not our clients, such as a client's employees, other drivers, injured people and witnesses, we rely on legitimate interests: our client's interest, and ours, in having claims reported, handled and settled properly.

We share your personal data with third parties only where necessary:

— Insurers and underwriters, to obtain and place cover. — Premium finance providers, where you choose to pay by instalments. — Credit reference agencies, where you apply for premium finance. A credit search will leave a record on your file. — Industry anti-fraud databases, including the Claims and Underwriting Exchange and the Insurance Fraud Bureau, which insurers use to detect and prevent fraudulent claims. — Loss adjusters and claims handlers, in the event of a claim. — Regulatory bodies including the FCA, where required by law. — IT service providers who support our business operations, under appropriate data processing agreements.

We do not sell your personal data to third parties.

Our clients can give their staff the CRS Claims app so they can report a claim to us from their phone. The rest of this notice also applies.

What the app collects: — About you, when you set up the app: your name, mobile number, the company you work for if you give it, and the business you report for. Your employer gave us your business details when they set up the app for their staff. — In each report: what happened in your own words, when and where it happened, your location if you tap “Use my current location”, photos and documents you add, an estimated cost, a policy number and any reference numbers you give us. — About other people: the name, role and phone number of anyone you tell us was involved, such as another driver or a witness. Photos and descriptions can also include other people, vehicles and number plates. — To keep the app secure: a sign-in identifier for your phone, and, when a new phone is set up, the information Cloudflare needs to check that a person rather than an automated program is setting it up (such as your IP address and browser details).

A report about an injury may include information about someone's health, and a report about a theft or an accident may include information about an alleged offence. We use that information only to report, manage and settle the claim, as described in “What data we collect”.

The app does not collect your email address, record sound itself, track your location in the background, or use advertising or analytics tools.

We use the information to receive your report, contact you about it, notify the insurer and handle the claim on our client's behalf. We also use the time each report reaches us to check how quickly we respond.

If you name other people in a report, please let them know that you have passed their details to CRS for the claim. We use their details only for that claim. If we contact them, we will point them to this notice.

The report goes to our claims team by email and is filed in our claims system. We share it with the insurer and with anyone they appoint to handle the claim, such as a loss adjuster, as described in “Sharing your data”. The companies that run the app for us are: — Supabase, which stores reports and photos for the app, in London. — Microsoft, which provides our email. — Cloudflare, which runs the check when a new phone is set up and when our staff sign in. — Apple and Google, which distribute the app and receive crash reports. They do not receive the content of your reports, except that if you use your keyboard's microphone to dictate, your phone's own dictation service handles what you say.

Some of these companies may access information from outside the UK. Where they do, we rely on the protections described in “Sending data outside the UK”.

The app keeps a copy of each report for 90 days after it has reached our claims team, then deletes the description, photos, location and other people's details automatically. We keep a short record that a report was made and when, for as long as we keep the claim file. The report we filed in our claims system is kept with your other claim records, as described in “Data retention”.

On your phone, a report and its photos are removed as soon as they have been sent. You can remove the app's link to your business at any time from the “This phone” screen.

Some of the insurers and reinsurers we approach sit outside the UK. Risks placed at Lloyd's are frequently shared with overseas markets, and a claim on such a policy will involve parties abroad. Google, who provide the analytics on this website, also process data outside the UK, as may the service providers who support our systems.

Where personal data leaves the UK we rely either on the adequacy regulations made by the UK government, or on the International Data Transfer Agreement, so that it remains protected to the same standard as it would be here.

We do not make automated decisions about you. Insurers and finance providers often do. Much commercial underwriting and pricing is now automated, and an application for premium finance will usually involve an automated credit decision.

If a decision affecting you was taken automatically, you can ask for a person to look at it again. Tell us and we will take it up with the insurer or finance provider on your behalf.

We retain your personal data for as long as we have a business relationship with you, and thereafter for a minimum of seven years in accordance with FCA record-keeping requirements and relevant limitation periods under UK law.

Where data is no longer required, it is securely deleted or anonymised.

Under UK data protection law, you have the right to:

— Access the personal data we hold about you. — Correct inaccurate or incomplete data. — Request erasure of your data in certain circumstances. — Object to or restrict certain types of processing. — Receive a portable copy of your data. — Withdraw consent where processing is based on consent.

To exercise any of these rights, or to raise a concern about how we handle your data, please contact us at info@crs-ins.co.uk or call 01455 244630.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We may update this privacy policy from time to time. The current version will always be available on this page. Where changes are material, we will notify affected individuals directly.

This policy was last reviewed in October 2026.