Legal information - Privacy Notice

Charles Frank Finance Limited is the data controller for personal information handled through the Simply Zest website and brand. It is registered in England and Wales under company number 07791769, with a registered office at 89 Cardiff Road, Taffs Well, Cardiff, CF15 7PL. Its Information Commissioner’s Office registration number is Z2962200.

Our data protection officer is John Lugsdin. You can contact him about privacy or to exercise a data protection right by emailing john.lugsdin@cffl.co.uk or writing to the registered office above.

This notice covers information collected when you visit simplyzest.co.uk, request a quote, contact us, submit Consumer Duty feedback, make a partnership enquiry or go on to receive protection insurance advice through Simply Zest.

If you become a client, we may also give you additional privacy and regulatory information during the advice and application process. Insurers and other product providers act under their own privacy notices when they receive and assess an application.

Information you provide through this website

• identity and contact information, such as your name, email address, telephone number and postcode;
• enquiry information, including the type, amount and term of cover you are considering and any message you send;
• intermediary information, such as company name, FCA number and the support requested;
• customer feedback, including adviser name, cover commencement date, ratings and comments; and
• security information needed to protect forms from abuse, including a Turnstile verification token and technical information associated with the request.

Information used during advice

If you ask us to advise or arrange cover, we may need more detailed information about your family, occupation, income, expenditure, financial commitments, existing cover, lifestyle and the protection outcome you want. We may also need health and medical information when this is relevant to insurance underwriting.

Health information is special category data. We only use it where the law permits and where it is necessary for insurance advice, underwriting or related claims support. We will provide any additional explanation or obtain consent where required. Please do not include detailed medical information in a general website message unless we have asked you to do so through an appropriate route.

Information from other sources

An intermediary or professional contact may send us your details with your knowledge or permission. During an advised application, we may receive information from insurers, medical professionals, your employer, public registers or other organisations you authorise us to contact. Where required, we will tell you the source when we first contact you or otherwise within the applicable legal period.

You do not have to submit a website form. However, fields marked as required are needed for us to receive, protect and respond to that request. If you ask us to advise or arrange insurance, failure to provide information needed for suitability or underwriting may mean we cannot provide the service or an insurer cannot offer cover.

Where necessary for the purposes above, recipients may include:

• insurers, reinsurers, underwriting services and medical evidence providers involved in an application;
• authorised intermediary partners or professional advisers involved in your referral, where you expect or authorise the sharing;
• Cloudflare, which provides website hosting, database and Turnstile security services;
• Resend and relevant email providers, which deliver internal enquiry notifications;
• IT, compliance, legal, audit and other professional service providers working under appropriate duties;
• the Financial Conduct Authority, Financial Ombudsman Service, Information Commissioner’s Office, law enforcement, courts or other authorities where required or permitted by law; and
• a purchaser, successor or adviser involved in a genuine business restructure, subject to appropriate confidentiality and legal safeguards.

We do not sell personal information submitted through Simply Zest forms.

Some technology or insurance service providers may process information outside the United Kingdom. Where UK data protection law requires a safeguard, we use an applicable adequacy regulation, approved contractual protections such as the UK International Data Transfer Agreement or Addendum, or another lawful transfer mechanism. You can ask us for more information about safeguards relevant to your data.

We keep personal information only for as long as needed for the purpose collected and to meet legal, FCA, insurance, complaints, audit and record-keeping requirements. The period depends on whether an enquiry progresses, the service or policy involved, the sensitivity of the information, limitation periods and whether a complaint, claim or investigation is active.

Enquiries that do not proceed are reviewed and deleted or anonymised under our retention schedule when there is no continuing lawful need. Client and advice records may need to be kept for longer regulatory or legal periods. Security logs and short-lived verification tokens are normally retained for much shorter periods by the relevant service provider.

We use organisational and technical measures intended to protect information, including access controls, encrypted connections, server validation, form limits and bot protection. No internet service can promise absolute security, so please use the contact details above if you need an appropriate route for particularly sensitive documents.

Cloudflare Turnstile automatically assesses browser and request signals to distinguish likely people from automated traffic. This can decide whether a form submission is accepted for processing, but it does not make an insurance eligibility, pricing or advice decision. We do not use the website to make solely automated decisions that have a legal or similarly significant effect on you.

Depending on the circumstances and lawful basis, you may have rights to access your information, correct it, ask for deletion, restrict its use, receive portable data, and withdraw consent. These rights can be limited where the law requires or permits us to retain or continue processing information.

To exercise a right, contact us using the details in section 1. We may ask for information to confirm your identity. You also have the right to complain to the Information Commissioner’s Office, although we would appreciate the opportunity to address your concern first.

Our Cookie Notice explains the website’s current use of browser storage, Cloudflare security services and Turnstile. We do not currently include advertising or behavioural analytics scripts in the Simply Zest application.

We review this notice when our services, providers or legal obligations change. The date at the top identifies the latest version. If a change materially affects how we use information already collected, we will take reasonable steps to bring it to the attention of affected people before the new use begins where required.