Privacy Policy

Part B Privacy Notice

Surefire Partners Ltd is the controller of personal data used to operate Contractor Benefits. This means we decide why and how that platform data is used. This notice applies to members, people making enquiries and people contacting us about the platform. Our contact details are at the beginning of this document.

1 How the organisations involved relate to you

The accountant, umbrella company or other organisation giving you access is responsible for its own relationship with you and its own privacy information. Branding the platform does not make that organisation the operator of Contractor Benefits. We use your organisation association to confirm access, present the correct experience, route enquiries and account for the partnership.

Providers receiving a requested referral, Circular Benefits for its connected platform and byond for its cashback service generally act as independent controllers for their own services. They explain their processing in their own notices. Technology suppliers acting only on our instructions act as processors under appropriate contractual arrangements. Where a specific arrangement involves different roles, we will explain that arrangement before the relevant processing.

2 Information we collect

• Account and access information: your name, email, user identifier, organisation association, verification status and account security records. Login credentials are handled through the authentication service; passwords are not passed to benefit providers.
• Profile and enquiry information: phone number, contact preference, selected subjects, work arrangement, relevant business details, mortgage goal, vehicle requirements, notes and other answers you choose to provide.
• Your optional records: products you say are already arranged, estimated renewal or review dates, mortgage deal-end dates, saved interests and reminder settings. An unanswered item is not evidence that you lack cover.
• Referral and commercial records: enquiry references, recipients, dates, the version of information shown when you submit, contact attempts and limited provider feedback about whether an enquiry resulted in business, together with related commission and reconciliation records.
• Preferences and communications: email choices, unsubscribe and suppression records, notices and terms versions, support correspondence and records needed to show what you requested.
• Technical and usage information: IP address, browser and device information, session and security logs, pages or categories used, offer and vehicle clicks and other proportionate engagement events. The collection of device information or email engagement measurements is subject to the rules explained below.

We receive information from you, from the organisation providing access where necessary, from our authentication and delivery systems, and from providers giving limited referral or conversion feedback. When information is supplied by another party, we use it only for the relevant purposes and provide privacy information as required.

3 Information you need to provide

Account identity, a valid email and the information necessary to confirm eligibility are required to provide a registered account. Contact details and the minimum information needed to identify the subject and recipient are required for a callback. If you do not supply these details, we may be unable to complete that function. Optional profile details, notes, coverage records and estimated dates are not a condition of access.

We do not need salary or date of birth for the standard CB sign-in connection. We do not ask you to complete insurance underwriting, upload financial documents or supply medical evidence through the general platform enquiry. If a specialist needs those details, provide them directly through its secure process.

Please avoid medical diagnoses, detailed health information, bank or card details, identity documents and unnecessary information about other people in free-text fields. If sensitive information is sent inadvertently, we will restrict access and assess whether to remove it or arrange an appropriate secure route. Where special category data is genuinely necessary, we will identify a valid additional legal condition and give any further notice or obtain any explicit consent required before using it. Acceptance of this notice alone is not explicit consent to process medical information.

4 Our purposes and legal bases

For account creation, authentication, eligibility, saved choices and the functionality you request, we rely on performance of our agreement with you where the processing is necessary for that agreement. We also use legitimate interests for proportionate administration of the participating organisation relationship and prevention of misuse. Those interests are delivering the agreed service to eligible people and protecting other users.

For a callback or enquiry you deliberately submit, we rely on performance of the platform agreement where necessary to provide the referral function to you. Where the enquiry is on behalf of a company rather than you personally, we may rely on legitimate interests in making the connection you requested for that company. The processing is limited to arranging that connection; it is not general permission to market unrelated products. Providers determine the appropriate basis for their subsequent advice and services.

For security, troubleshooting, fraud prevention, audited support access and proportionate service improvement, we rely on legitimate interests in providing a reliable and secure platform, understanding performance and resolving problems. We assess necessity and the effect on your rights. Where a device storage or tracking rule requires consent, we obtain that permission separately.

For attribution, provider conversion checks, commission reconciliation and proportionate partner reporting, we rely on legitimate interests in administering and verifying our commercial arrangements and detecting missing or duplicate payments. Information is limited to what that task needs. Applicable tax, accounting, regulatory or court requirements may also require processing under a legal obligation.

For optional email marketing, we use consent where required by the electronic marketing rules. We rely on another permitted route, such as a valid soft opt-in or the rules for corporate subscribers, only where its conditions actually apply. Where legitimate interests is the data protection basis for a permitted marketing route, our interest is communicating relevant services and offers, subject to your right to object. We do not assume that every contractor uses a corporate email subscription.

For date reminders you request, we use the information needed to deliver that function and apply the relevant communication rules. Where a reminder includes a promotion or invitation to obtain a quote, we treat that content as marketing and respect applicable permissions and objections. For genuine service notices and rights requests, we rely on our service obligations, legitimate interests or legal obligations as appropriate to the purpose.

Where we rely on consent, you can withdraw it at any time without affecting processing that was lawful before withdrawal. Where we rely on legitimate interests, you can object. We will consider an objection and stop the processing unless a lawful exception applies. An objection to direct marketing is absolute: we will stop using your information for that marketing.

5 What happens when you request a callback

Before submission, the form identifies the provider or providers and the subjects selected. Pressing the request button tells us to make that connection. We send your name, verified email, phone, contact preference and the relevant enquiry answers or notes. Depending on the subject, these may include your work arrangement, business description, mortgage type or a selected vehicle and its requested lease terms.

The provider also receives the enquiry reference and source organisation so it can respond, identify the introduction and report the relevant outcome. It does not receive unrelated enquiries, your password, your whole account history or all the coverage records you have saved. Several relevant subjects for the same provider may be included in one request.

Depending on your organisation’s configuration, recipients may include Contractor Financial for protection and mortgage enquiries, Radar Insurance for business cover, Fleet Prices for vehicles and Accord Legal Services for wills and related legal services. Your organisation may use another provider. The recipient named on the enquiry form takes precedence over this example list.

Providers may return limited status, conversion, product category, transaction or commission information so we can trace the enquiry, support you and reconcile referral income. This is not a request for their detailed medical, underwriting, credit or legal case file. Choosing to be contacted does not authorise unrelated advertising from that provider. Contact the provider directly to manage its subsequent communications and data rights.

6 Circular Benefits single sign on and linked retailers

When you choose a connected CB module or card, we send Circular Benefits Limited a stable external member identifier, your first name, surname and verified email to create or update your CB account and obtain a short-lived sign-in link. Organisation identifiers may also be supplied where needed for the agreed account arrangement. We send the destination needed to open the selected offer or module. We do not send your password, salary, date of birth or unrelated specialist enquiry answers for standard sign-in.

CB may ask you to accept its terms and privacy information before using its service. It manages its own account, activity and fulfilment arrangements, including any further sign-in to its partners. Closing your Contractor Benefits account does not necessarily close a separately held CB or retailer account; ask the relevant controller about its account and retention rules.

Some promotional links go directly through a retailer or affiliate network rather than CB single sign-on. Clicking can disclose ordinary browser information such as your IP address and an offer or referral identifier to the destination and its network. Any cookies or tracking used there are governed by the applicable rules and the destination’s information and choices. You can choose not to follow a link.

7 Cashback and other external accounts

When you use a byond registration or login button, you leave our platform for byond’s service. The registration link may identify the partner programme. We may record that the button was clicked for service and referral reporting; it does not give us your byond password, payment card details, card balance or full spending history.

byond and its responsible providers explain the personal information needed for registration, identity checks, payments, the card and cashback in their own notices. Other external services operate in the same way unless a specific integration tells you about an additional data transfer before it happens.

8 What your organisation can see

We provide participating organisations with reporting about access, engagement, referrals, conversions and revenue attributable to their partnership. We use aggregated or anonymised information wherever practical. Where individual information is necessary for eligibility, support or referral reconciliation, authorised users may receive limited account or referral identifiers and relevant administrative details.

This does not give an accountant, umbrella company or employer routine access to medical information, financial documents, detailed legal instructions or unrestricted free-text enquiry notes. Access to personal information must be proportionate to the task and restricted by role. We do not give one organisation access to another organisation’s members or enquiries.

Your organisation may independently hold information about you through its existing service. Its own privacy notice explains that processing. You can ask us what partnership information about your use has been shared.

9 Other recipients and support access

Our technology and operational suppliers may handle information for hosting, databases, authentication, storage, email delivery, support, monitoring and security. The platform uses Lovable Cloud infrastructure and authentication services; Brevo is used for email communication. Only the information needed for the relevant service should be supplied to each processor, under appropriate instructions and security terms.

Authorised platform administrators may access information needed to investigate an issue, correct a record or support you. Support simulation or acting within an account is restricted and audited; it is not permission for staff to browse member information without a work purpose. Provider staff should see only enquiries assigned to their organisation and responsibilities.

We may disclose information to professional advisers, insurers, auditors, courts, regulators, law enforcement or other parties where required by law or necessary to establish, exercise or defend legal claims. If the platform business is sold or reorganised, relevant information may transfer subject to confidentiality, lawful safeguards and appropriate notice. We do not sell member contact lists for unrelated third-party marketing.

10 Emails preferences and unsubscribe

Account and service emails include verification, password resets, security notices, information needed to deal with a request and material changes to your account or this service. These are not optional advertising simply because they arrive by email. We keep them limited to their service purpose.

Optional emails can include weekly vehicle deals, Everyday Savings, platform offers and relevant invitations to obtain specialist help. You can use My account to manage the available categories and the overall offer setting. Each marketing email must provide an effective unsubscribe route. You can also contact helpdesk@contractorbenefits.com. We maintain a limited suppression record so an objection is not lost when other account details change.

Adding a renewal date can request the reminder described beside that action. You can turn reminders off or change or remove the date. A reminder that encourages a new quote or product review is promotional and must follow the applicable marketing rules. Switching off marketing or objecting to it must not be bypassed by classifying that message as essential.

A privacy notice explains processing; it does not itself sign you up to newsletters. Where permission is required, we record the relevant choice separately. Provider follow-up about an enquiry and provider newsletters are also separate: deal with the provider directly if you want it to stop its own communications.

We may use delivery, bounce and unsubscribe information to operate email reliably. Any individual open or click tracking involving storage on or access to your device is used only where the applicable permission or exemption requirements are met, with clear information. We do not treat marketing consent as unlimited permission for tracking.

11 Cookies storage and usage measurement

The platform uses cookies or similar storage needed for secure sign-in, access controls, fraud prevention and choices you request. Essential functions may not work if you block the relevant technology. Some presentation preferences may be stored locally on your device.

Non-essential analytics, advertising, cross-site tracking or email tracking are not automatically authorised by using the site. Where consent is required, we ask before the technology is used and provide a way to change that choice. A statutory exception is used only where all its conditions are met, with any required information and opt-out.

Server records can include logins, page or category events and referral clicks for security, support and proportionate reporting. We minimise identifiers and avoid collecting unnecessary content. Currently the platform stores your sign-in session in your browser’s local storage so you stay signed in, and keeps a random activity identifier in session storage for the current browser session so related page and category events can be grouped. We do not use third-party analytics or advertising cookies on the platform. Third-party sites apply their own cookie choices when you visit them.

12 International processing and security

The platform’s application database is configured in the Europe region. That does not mean every supplier, support operation, email service or independent provider processes information only in the UK or Europe. Where personal information is transferred internationally, we identify the relevant countries and use a lawful transfer mechanism where required, such as UK adequacy regulations or approved contractual safeguards together with the required assessment and supplementary measures.

You can ask helpdesk@contractorbenefits.com for information about applicable international recipients, processing locations and safeguards, including a copy of relevant safeguards with confidential details protected where appropriate. Any specific material transfer arrangements must also be made clear in the current supplier or transfer information available with this notice.

We use proportionate organisational and technical measures, including access restrictions, authentication, separation between organisations, secure communications and auditing of privileged actions. No online service can promise absolute security. We investigate suspected incidents and notify affected people and authorities where the law requires.

13 How long we keep information

We retain information only while it is needed for the purpose for which it was collected, a compatible lawful purpose or an applicable legal requirement. We assess the type of record, whether an enquiry or contract is still active, outstanding complaints, accounting requirements, limitation periods and the possibility of a genuine dispute. We review continuing retention rather than keeping all member data indefinitely.

Account and optional profile records are needed while access is active. On closure or a valid erasure request, we delete or anonymise information no longer needed and restrict any retained records to the remaining lawful purpose. Unsubmitted enquiry details and saved dates are removed when deleted by you or when the account is erased, unless a specific lawful reason requires limited retention.

Submitted enquiry and commercial records may need to remain after account closure to resolve an enquiry, verify commissions, meet financial record duties or establish or defend a claim. We minimise retained identity and separate financial evidence from unnecessary enquiry content. Where a tax or accounting rule requires a record, the applicable statutory retention period applies; we do not use that as a reason to retain all free-text or account information.

Preference, notice and request-authorisation records are retained for as long as reasonably necessary to evidence the relevant choice, meet obligations or resolve disputes. A minimal email suppression record may remain while needed to honour an unsubscribe. Security and usage records are kept for a proportionate operational or investigation period and then deleted or anonymised. Backups are removed or overwritten through their normal retention cycle and are not used to restore erased accounts into active service.

You can ask us for the retention period or criteria applicable to a specific record. Independent providers set and explain their own retention periods; our account deletion does not automatically erase their records.

14 Personalisation and automated processing

We may use your organisation, work arrangement, selected interests, saved dates and activity to present relevant options, order content and send permitted reminders. For example, work arrangement can affect which business vehicle route is available and a saved renewal date can trigger an eligible reminder.

These functions do not decide whether you receive insurance, credit, a mortgage or a legal service. We do not make solely automated decisions through the platform that have legal or similarly significant effects on you. Providers may carry out their own eligibility, credit, fraud or underwriting decisions and must explain these separately. If a rule hides an option you believe is relevant, contact us so the circumstances can be checked.

15 Your data protection rights

Depending on the processing and applicable exemptions, you can ask to access your personal data, correct inaccurate information, erase data no longer lawfully needed, restrict processing or receive certain information in a portable form. You can object to processing based on legitimate interests and withdraw consent where we rely on it. These rights are not all absolute and do not always require us to delete information retained under a valid legal obligation or for a legal claim.

You have a separate right to object to direct marketing at any time. We will stop the marketing, including related marketing profiling, without requiring you to close your account. Use the unsubscribe link, My account or helpdesk@contractorbenefits.com.

For other requests, contact helpdesk@contractorbenefits.com, identifying the account and request without sending unnecessary sensitive documents. We may ask for proportionate identity information where reasonably necessary. We normally respond within one month, subject to any lawful extension or permitted adjustment to the time limit. We will explain an extension, refusal or applicable charge where the law requires; ordinary requests are handled free of charge.

You can request account deletion in My account. A deletion request is assessed against legal retention requirements and does not cancel contracts or close independent provider accounts. Contact those providers to exercise rights over the information they control. We can help identify the recipient of a particular referral.

16 Privacy complaints and updates

Please contact helpdesk@contractorbenefits.com if you are concerned about our use of information. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113. You do not have to use our complaints process before approaching the ICO.

We may update this notice to reflect changes in the service, suppliers or law. The effective date identifies the current version. We will give appropriate notice of a material change before using information in a materially different way and obtain fresh permission where required. We do not treat publication of a new notice as permission for an unrelated use of personal information.