Customer Sign in

Choose from the options below to access your secure members area:

Identity Protection from CPP provides support, expertise and insurance cover to help you combat and recover from identity theft and identity fraud.

Sign in

Card Protection is a comprehensive service for use in the event of card loss, theft and related fraud.

Sign in

The definitions in the Card Protection Product terms and conditions apply when used in this Privacy Notice, which sets out how CPP processes Your personal information

  1. Information about CPP

CPP takes the privacy of its customers seriously and is responsible for Your personal information. CPP is part of the CPPGroup Plc group of companies (“CPP Group”). You can find out more about the CPP Group by visiting www.cppgroup.com. You can contact CPP using the details in Section 2:B of these terms and conditions.

Further questions about this Privacy Notice, including any requests to exercise Your legal rights, please contact CPP:

  • by post at: Data Protection, Card Protection Plan Limited, PO Box 1419, Sunderland, SR5 9RN; or
  • by email at: DataPrivacy@cpp.co.uk

 

  1. What personal information is collected?

CPP may collect and use the following information:

  • Your name and contact information (including email address and mobile phone number);
  • Your date of birth;
  • financial information including bank account details and card payment details and details of any cards You wish to register with CPP;
  • details of Your mobile phone (if applicable to Your Product), passport and/or driving licence;
  • information that the Main Product Holder provides when they renew their Product;
  • records of any correspondence with You regarding any specific enquiry You make, for example if You call, email or write to CPP. CPP will also hold copies of letters or emails You send or documents You provide in relation to Your Product where this is relevant, for example bank statements; and
        • information about other products and services You obtain from members of the CPP Group.

 

  1. How CPP uses Your personal information

CPP will only use Your personal information when the law allows it to. Most commonly, CPP will use Your personal information where:

  • it needs to perform the contract for the CPP Agreement it is about to enter into or has entered into with the Main Product Holder.
  • it is necessary for CPP’s legitimate interests (or those of a third party) and Your interests and fundamental rights do not override those interests.
  • CPP needs to comply with a legal or regulatory obligation.

Where CPP processes Your personal information for direct marketing purposes it will do so on the basis that You have given Your consent to the processing of Your information for this specific purpose.

 

  1. What does CPP do with Your personal information?

Set out in the table below is a description of all the ways CPP uses Your personal information and which of the legal bases it relies on to do so, including CPP's legitimate interests where appropriate.

CPP may process Your personal information for more than one lawful ground depending on the purpose for which it is using Your information. Please contact CPP if You need details about the specific legal ground it is relying on to process Your information if more than one is shown.

 

Purpose/Activity

Lawful basis for processing including basis of legitimate interest

To make decisions on the Product. CPP does not envisage that any decisions will be taken about You using automated means, however CPP will notify the Main Product Holder in writing if this position changes;

Performance of the contract for the CPP Agreement

To process, provide You with and manage the CPP Agreement and provide the benefits described in these terms and conditions

Performance of the contract for the CPP Agreement

To communicate with the Main Product Holder by email, telephone or post regarding transactions between the Main Product Holder and CPP or the Main Product Holder customer relationship with CPP

Performance of the contract for the CPP Agreement

To contact You regarding any specific enquiry You make

Performance of the contract for the CPP Agreement

To collect payments from the Main Product Holder

Performance of the contract for the CPP Agreement

Internal record keeping

(a) Necessary for CPP’s legitimate interests (for running its business)

(b) Necessary to comply with a legal obligation

To improve its products and services

Necessary for CPP’s legitimate interests (to develop its business and inform its marketing strategy)

Statistical analysis

Necessary for CPP’s legitimate interests (to study statistical trends within the business, to develop its business and inform its marketing strategy)

Fraud prevention

Necessary to comply with a legal obligation

Debt collection

Necessary for CPP’s legitimate interests (to recover debts due to it)

To contact You by e-mail, telephone or post in order to share information with You about products, services and events from CPP and other members of the CPP Group that may be of interest to You

You have consented to this.

To contact You for market research purposes, if You have not objected to such use

Necessary for CPP’s legitimate interests (to understand whether customers value their product, to help it provide a better service to You, and to develop and improve its products and services)

To confirm the Main Product holder’s correct address with third party ID service providers in order to contact or update the Main Product Holder as required

(a) Necessary for CPP’s legitimate interests (for running their business and helping to provide a better service to You)

(b) Necessary to comply with a legal obligation

 

  1. If You fail to provide personal information

Where CPP need to collect and use personal information by law, to enter into, or under the terms of a contract for the CPP Agreement which it has with the Main Product Holder, and they fail to provide that information when requested, CPP may not be able to enter into or perform the CPP Agreement.

 

  1. Direct Marketing and Market Research

CPP may wish to provide You with information about CPP Group’s new products, promotions, special offers and other information which may be of interest to You and invite You to take part in market research. This communication may occur by post, telephone, email or SMS (unless You have asked CPP not to do so). CPP will ensure that any direct marketing or market research by electronic means will provide a simple means to opt-out.

You can change Your mind at any time about marketing or taking part in market research by informing CPP. In such cases CPP would not necessarily remove all Your personal data from its database(s) but would note and respect Your changed preferences. CPP will stop any marketing or market research to which You object or withdraw Your consent to within a reasonable period, in order to allow sufficient time for the change to be administered.

 

  1. Who does CPP share Your personal information with?

Service Providers

Personal information will be made available to CPP's authorised service providers (including other companies in the CPP Group which provide services to CPP) and third party suppliers, including ID checking service providers, which perform certain services on CPP’s behalf e.g. confirming the current address for customers, providing certain benefits under the CPP Agreement, providing IT support and maintenance, call handling services, hosting services, online payment services and marketing services. These service providers may have access to personal information needed to perform their functions on CPP's behalf but are not permitted to share or to use such information for any other purpose. CPP require all third parties to respect the security of Your personal information and to treat it in accordance with the law.

 

The Insurer

CPP will send limited information to the Insurer. The information provided to the Insurer by CPP is generally limited to non-personal information such as the number of policies sold by CPP to be underwritten by the Insurer. CPP may also pass personal information to the Insurer in order for the Insurer to comply with its audit requirements in respect of the policies it underwrites.

In the event that CPP is no longer able to administer the Policy, CPP will pass personal information including the Main Product holder's name and financial information to the insurer for them to continue to administer the Policy. In this case, the Insurer would use the information supplied to them for underwriting, policy administration, claims management and other insurance purposes, as further described in their Data Protection Statement at Section 4:F of these terms and conditions.

 

When You use the features of the CPP Agreement

If You report a lost card to CPP, Your name, address, date of birth, telephone number, bank account number, sort code (where relevant) and the card number (unless CPP notifies the card issuer of the loss by telephone, will be passed to the card issuer.

If You make a Claim under the Policy, CPP may share Your information with the police, other insurers and fraud prevention agencies to prevent fraudulent claims.

To help assess whether You qualify for emergency financial help (where such help is requested), CPP will, with Your consent check Your credit rating with a credit reference agency who will keep a record of this enquiry. Other organisations may then use this information for credit assessments or to trace debtors and prevent fraud. Please note that withholding Your consent to CPP checking Your credit rating in the manner described above may prejudice Your ability to benefit from the emergency financial help features of this Policy.

 

Third party companies who provide aspects of the CPP Agreement

Cifas - If You report the loss of important documents, such as passport or driving licence, if You consent, Your personal information will be used to create a Protective Registration record about You within the Cifas National Fraud Database, which will then be made available to the members of Cifas and to fraud prevention agencies participating in Cifas. The Protective Registration record will be used to help prevent fraud and money-laundering and to verify Your identity. There may be a slight delay when You apply for financial products and services as extra checks are made. Where the risk of fraud is very low some companies may instead accept the application and then contact You separately to ensure the application is from You. Further details of how Your information will be used by Cifas, and Your data protection rights, can be found by contact CPP.

 

Other companies within the CPP Group

CPP may share limited personal information with companies in the CPP Group e.g. to the extent needed for proper management and parental analysis and decision making.

 

Other organisations

CPP may also disclose Your personal information:

  • In response to a court order, or a request for cooperation from a law enforcement or other government agency;
  • To establish or exercise CPP’s legal rights; to defend legal claims; or as otherwise required or permitted by applicable laws and/or regulations;
  • When CPP believe that disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding illegal activity, suspected fraud, or other wrongdoing; to protect and defend the rights, property or safety of CPP, other CPP Group members, customers, staff, suppliers or others; to comply with applicable law or cooperate with law enforcement; or to enforce CPP’s terms or other agreements;
  • To prospective or actual buyers in the event that CPP sell any of their business or assets, or to other CPP Group members in the event of a reorganisation.

CPP will not otherwise transfer, disclose, sell, distribute or lease Your personal information to third parties unless they have Your permission to do so or are otherwise required or permitted to by law.

 

  1. Will personal information be transferred abroad?

The Insurer and CPP will ensure that if they transfer Your personal information from countries inside the European Economic Area (“EEA”) to countries outside the EEA, adequate safeguards are put in place to protect Your personal information in accordance with any applicable data protection legislation from time to time in force including the Data Protection Act 2018 or any successor legislation and (for so long as and to the extent that the law of the European Union has legal effect in the UK) the General Data Protection Regulation (GDPR). Please get in touch using the contact details set out in section 1 of this Privacy Notice if You want further information on the specific mechanism used by the Insurer and/or CPP when transferring Your personal data out of the EEA.

 

  1. Will my personal information be transferred abroad?

CPP will ensure that if it transfers Your personal information from the United Kingdom or countries inside the European Economic Area (EEA) to countries outside of the EEA, adequate safeguards are put in place to protect your personal information. Please get in touch using the contact details set out in section 1 of the Privacy Notice if You want further information on the specific mechanism used by CPP when transferring Your personal date to countries outside the EEA.

 

  1. How long will CPP hold personal information?

CPP will retain Your personal information for the period necessary to fulfil the purposes outlines in this Privacy Notice unless a longer retention period is required or permitted by law. CPP has to keep basic information about its customers (including contact details, financial information and details relating to policies) for at least seven years after they cease being a customer for tax and legal purposes.

 

  1. Your rights

Under certain circumstances, by law You have the right to:

  • Request access to Your personal information (commonly known as a “data subject access request”). This enables You to receive a copy of the personal information CPP holds about You and to check that it is lawfully processing it.
  • Request correction of the personal information that CPP holds about You. This enables You to have any incomplete or inaccurate information CPP holds about You corrected. If You think any information CPP has about You is incorrect or incomplete, please contact CPP as soon as You can. CPP will correct or update any information as soon as possible.
  • Request erasure of Your personal information. This enables You to ask CPP to delete or remove personal information where there is no good reason for CPP continuing to process it. You also have the right to ask CPP to delete or remove Your personal information where You have successfully exercised Your right to object to processing (see below), where CPP may have processed Your information unlawfully, or where CPP are required to erase Your personal information to comply with the law. CPP may not always be able to comply with Your request of erasure for specific legal reasons which will be notified to You, if applicable, at the time of Your request.
  • Object to processing of Your personal information where CPP are relying on a legitimate interest (or those of a third party) and there is something about Your particular situation which makes You want to object to processing on this ground. You also have the right to object where CPP are processing Your personal information for direct marketing purposes.
  • Request the restriction of processing of Your personal information. This enables You to ask CPP to suspend the processing of Your personal information, for example if You want CPP to establish its accuracy or the reason for processing it.
  • Request the transfer of Your personal information to another party.

To request any of the above, contact CPP.

You will not have to pay a fee to access Your personal information (or to exercise any of the other rights). However, CPP may charge a reasonable fee if Your request for access is clearly unfounded or excessive. Alternatively, CPP may refuse to comply with the request in such circumstances. CPP may need to request specific information to help confirm Your identity. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

CPP will try to respond to all legitimate requests within one month. Occasionally it may take CPP longer than a month if Your request is particularly complex or You have made a number of requests. In this case, CPP will notify You and keep You updated.

You also have the right to make a complaint at any time to the Information Commissioner's Office ("ICO"). CPP would appreciate the chance to deal with any concerns before You approach the ICO so please contact CPP in the first instance.