Blink Privacy Policy – Cyber Insurance


Welcome to Blink Innovation (UK) Limiteds privacy notice. This privacy notice provides details of how we will use, disclose, transfer and store personal information collected from you.

About us

Blink Innovation (UK) Limited is a company registered in England and Wales with company number 10257192 whose registered office is at 6 East Parade, Leeds, United Kingdom, LS1 2AD (Blink, us, we, our). CPP Secure is a trading name of Blink.

Blink is registered as a Data Controller with the Information Commissioners Office with the registration number ZA224060. Blink is registered with the Financial Conduct Authority with firm reference number 790304.

Blink is part of the CPPGroup Plc group of companies (CPP Group). You can find out more about the CPP Group by visiting

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact us or contact the DPO using the details set out below.

Blink sells, and in some cases is an administrator of, certain insurance policies. This privacy notice sets out how we will process personal information collected in relation to insurance policies, in accordance with the General Data Protection Regulation (GDPR). The provider of insurance will be referred to as the Insurer in this privacy notice and the company using such insurance will be referred to as the Insured.

Contact details
You can contact us:
by post at: Blink Innovation (UK) Limited, 6 East Parade, Leeds, United Kingdom, LS1 2AD; or
by email at:

You can contact the DPO:
by post at: Blink Innovation (UK) Limited, Data Protection Officer, 6 East Parade, Leeds, United Kingdom, LS1 2AD; or
by email at:

What personal information we collect and why

In order to administer the insurance policy to the Insured and for the Insurer to provide the insurance policy in accordance with the policy terms and conditions, we will obtain personal information about the individuals who purchased the insurance cover on the Insureds behalf (For example an administrator or employee of the Insured). We may obtain further information in any communication that you or the Insured sends to us including the communication content and metadata associated with the communication (if applicable) and any other personal information that you choose to send to us.
The information we have obtained or will obtain will be all or some of the following: your name, email address and other information contained in or relating to any communication that you send to us.

Should you need to amend details in relation to the Insureds insurance policy, we may request or obtain further information from you in order for the Insurer to provide the benefits under the insurance policy terms and conditions. Where we need to collect and use personal information by law, or under the terms of the contract for the insurance policy and you fail to provide that information when requested, we, and the Insurer, may not be able to perform the contract for the insurance policy.

How your personal information is used

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

  • Where we need to administer the insurance policy.
  • Where we need to comply with a legal obligation.

Set out below, in a table format, is a description of all the ways we use your personal information, and which of the legal bases we rely on to do so.


Purpose/Activity Lawful basis for processing

To provide the services associated with the insurance policy


Legitimate interest: to facilitate with delivery of the insurance policy


To administer the insurance policy including creating policy documentation, collecting and refunding premiums, and informing the underwriters of any business changes that affect the policy Legitimate interest: necessary for the administration of the policy
Internal record keeping Necessary to comply with legal and regulatory obligations

Who your personal information might be shared with

We may share your personal information with other organisations as necessary, these are:

  • The Insurer, approved suppliers and service providers (which will include other companies within the CPP Group which provide services to us) where this is reasonably required to provide the insurance policy, deal with your claim or provide services on our behalf. These suppliers may have access to personal information needed to perform their functions in relation to the insurance policy but are not permitted to share or to use such information for any other purpose.
  • Third parties where this is necessary to comply with any statutory, legal or regulatory obligations.
  • Other companies within the CPP Group e.g. to the extent needed for proper management and parental analysis and decision making.

How long your information is held

We will hold your information for the duration of the insurance policy and for seven years after it ends.

International transfers

We share your personal data with our service providers which may involve transferring your data outside the European Economic Area (EEA). Whenever we transfer your personal data out of the EEA we ensure a similar degree of protection is afforded to it by ensuring that where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to third countries.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

Data security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Your rights under Data Protection legislation

Under certain circumstances, by law you have the right to:

  • Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
  • Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected. If you think any information we have about you is incorrect or incomplete, please contact us as soon as you can using the contact details set out below. We will correct or update any information as soon as possible.
  • Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
  • Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
  • Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
  • Request the transfer of your personal information to another party.


If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, you can contact us:

  • by post at: Blink Innovation (UK) Limited, Data Privacy Officer, 6 East Parade, Leeds, United Kingdom, LS1 2AD;
  • by email at:

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

We will try to respond to all legitimate requests within one month from the date of your request. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (see We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Third party Websites

From time to time our website may include hyperlinks to, and details of, third party websites. We have no control over, and are not responsible for, the privacy policies contained on such third party websites and practices of third parties. This privacy notice does not extend to your use of our website and we recommend you check any applicable privacy policies before you submit any personal data to the website.