Privacy Notice
Last updated: 5th March 2026
The product
This Privacy Notice relates to the motor insurance distribution service made available through Bolttech Insurance Services (UK) LTD ("Bolttech", "we", "us", "our") in partnership with BYD UK ("BYD", "the Dealer") and Car Care Plan Limited ("CCP").
BYD will request your consent, within its own systems, to share relevant personal and vehicle data with Bolttech for insurance purposes. This consent is obtained by BYD as a separate data controller and under its own privacy notice. Bolttech does not control or manage this consent process.
Bolttech Insurance Services (UK) LTD's operates as an insurance broker, authorised and regulated by FCA. As part of the insurance distribution chain, Bolttech operates a digital platform ("the Platform") that enables customers introduced by the Dealer to obtain motor insurance quotations and, where applicable, to purchase motor insurance products.
The Dealer's role is limited to that of an introducer under the exclusion provided by Article 33B of the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001. The Dealer does not provide insurance advice, does not arrange insurance contracts, and does not act as a data processor for Bolttech.
Bolttech does not act as an insurer and does not underwrite insurance risks. Insurance benefits are provided by the insurer(s) named in your policy documents.
The applicable privacy notices of other controllers independently involved in the service can be found at:
- CCP (Car Care Plan Limited): https://staticuk.bydcare.saas.bolttech.eu/fairusenotice
- Insurer(s):
Insurer/Product Provider Name: | Privacy Notice can be obtained here: |
|---|---|
Allianz ABC Insurance (formerly LV ABC Insurance) | |
Ageas |
1. General Information on Data Protection
This Privacy Notice covers the processing of your personal data carried out by Bolttech in connection with the operation of the Platform and the provision of the insurance distribution service described above.
The Dealer transmits certain personal data to the Platform as a one-way, unidirectional act following your consent. The Dealer does not have access to the Platform, does not receive any personal data back from Bolttech, and does not act as a joint controller or data processor in relation to Bolttech's processing activities.
CCP and the insurer(s) each act as independent data controllers for their respective processing activities and have issued their own privacy notices, which apply separately.
Personal data means any information relating to an identified or identifiable natural person (the "data subject").
Any matters not expressly regulated in this Privacy Notice shall be governed by Bolttech's general Privacy Notice available at https://bolttech.io/privacy-notice-global/.
The responsible data controller and contact details
Bolttech
27 Old Gloucester Street, WC1N 3AX London, ENGLAND
Data Protection contact: bolttech Privacy Office
Email: [email protected]
Website: https://bolttech.io
2. Applicable Law
References to GDPR in this Privacy Notice refer to the EU General Data Protection Regulation (Regulation (EU) 2016/679) as retained in UK law under the European Union (Withdrawal) Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 ("UK GDPR"), read together with the Data Protection Act 2018 ("DPA 2018").
3. How We Obtain Your Personal Data
Your personal data is collected through two distinct channels, depending on the phase of the service:
Data received from the Dealer (both phases)
When you purchase or order a vehicle from one of our Dealer partners, the Dealer will request your consent, within its own systems, to share relevant personal and vehicle data with Bolttech for insurance purposes. This consent is obtained by BYD as a separate data controller and under its own privacy notice. Bolttech does not control or manage this consent process.
Subject to your consent, this data is transmitted to the Platform via a secure, unidirectional API integration. Bolttech receives and processes this data in its own right and does not rely on the Dealer's consent as its lawful basis for processing.
Data collected directly on the Platform (Phase 2 only)
In Phase 2 of the service, additional personal data required to generate an insurance quotation is collected directly from you through the Platform.
This data is not shared with or visible to the Dealer at any stage. It includes:
Page / Section | Data Fields |
|---|---|
Car Information | Vehicle registration number, manufacture year, model description, fuel type, number of seats, import status, current market value, tracking device fitted |
Personal Information | Title, first name, surname, date of birth, phone number, email address, postcode, full address, marital status, UK residency status and date (if applicable), home ownership, employment status, job title, industry, second employment details |
Driving Experience | Licence type, date of licence issue, DVLA medical restrictions |
Insurance History | Accidents/claims in last 5 years (date, type, fault, injury, NCB impact), motoring convictions in last 5 years (conviction date, type of conviction, penalty points, ban received). |
4. Categories of Personal Data, Legal Basis and Purposes of Processing
a. Categories of personal data processed
Depending on the phase of the process, Bolttech may process the following categories of personal data:
- Contact details: name, address, email address, telephone number, date of birth.
- Vehicle data: VIN, registration number, model, version, fuel type, engine capacity, import status, current value, tracking device information.
- Personal and socioeconomic data: marital status, residency, home ownership, employment and occupation details.
- Driving and insurance history: licence type and date, DVLA restrictions, accident and claim history.
- Criminal convictions data (Article 10 UK GDPR): motoring convictions in the last 5 years, including conviction date, type of conviction (DVLA endorsement code), penalty points, and ban received.
- Order and dealer reference data: sales order reference, dealer ID, consultant reference (used solely for internal record-keeping and traceability).
- Technically generated data: IP address, log files, session identifiers, device and browser information, security-related metadata.
b. Purposes and legal bases of processing
The points below summarise the purposes for which Bolttech processes personal data and the corresponding legal basis under the UK GDPR.
i. Pre-contractual steps and performance of a contract — Article 6(1)(b) UK GDPR
Where you request an insurance quotation or take steps towards subscribing to a motor insurance policy through the Platform, the following processing is necessary for the performance of the contract or to take steps at your request prior to entering into a contract:
- Receiving and processing data transmitted by the Dealer following your introduction, for the purpose of initiating the quotation journey on the Platform;
- Collecting and processing data you provide directly on the Platform to generate an insurance quotation;
- Transmitting data to CCP to enable CCP to obtain a quotation from the insurer(s) on your behalf;
- Customer onboarding, identity verification for insurance purposes, and policy administration support;
- Customer communications directly related to your quotation request or policy.
- We may use your Personal Data as necessary in relation to providing you with an insurance quotation, and/or the purchase of an insurance product including the provision of your renewal notice, expiry notice and anything else considered as important information regarding your insurance policy.
- We may use your Personal Data to communicate with you, including some or all of the following:
- Contact you via email to provide details of the quote you have received.
- Contact you via email to remind you if you received a quote but did not complete your purchase.
- Contact you by SMS and/or telephone (including mobile) regarding the quotation you have received on our Platform. This is a standard part of our service which enables us to follow up on the service provided, to correct inaccurate information provided during the quote process online and/or to answer any queries you may have.
- Contact you via SMS to provide details of Important telephone numbers and/or to advise of the expiry of your insurance policy.
- Contact you via SMS to remind you of the automatic renewal of your insurance policy (if applicable).
- Contact you via telephone (including mobile) prior to the expiry of your policy to discuss your renewal notice.
The data received from the Dealer is processed by Bolttech under this basis in its own right. Bolttech does not rely on the consent given by you to the Dealer as a lawful basis for its own processing.
ii. Legitimate interests — Article 6(1)(f) UK GDPR
Certain processing activities are carried out on the basis of Bolttech's legitimate interests, where those interests are not overridden by your rights and freedoms:
- Fraud detection, abuse prevention, and financial crime screening, to protect customers and the integrity of the Platform;
- IT and information security monitoring, including detection of unauthorised access or anomalous activity;
- Platform performance monitoring and technical optimisation, to maintain and improve service quality;
- Internal reporting, business analytics, and service development, using aggregated or pseudonymised data where possible;
- Record-keeping of dealer reference data (sales order number, dealer ID, consultant reference) for internal audit and traceability.
- We may use your Personal Data for the purpose of market research, customer satisfaction surveys, and data analytics, including profiling, to develop and enhance the customer relationship and journey as part of our business strategy.
- We may contact you via email inviting you to provide a public review of our service on a third-party website.
- We may contact you via email inviting you to take part in a survey or provide a review.
You have the right to object to processing based on legitimate interests at any time. Please see Section 9 for details on how to exercise your rights.
iii. Compliance with a legal obligation — Article 6(1)(c) UK GDPR
Personal data is processed where necessary to comply with legal and regulatory obligations applicable to Bolttech as an FCA-authorised insurance intermediary, including but not limited to:
- Obligations under the Financial Services and Markets Act 2000 (FSMA) and the rules of the Financial Conduct Authority (FCA), including conduct of business and record-keeping requirements;
- Obligations under the Insurance Distribution Directive (as implemented in UK law) and related FCA ICOBS rules;
- Anti-money laundering and counter-terrorist financing obligations under the Proceeds of Crime Act 2002 and the Money Laundering Regulations 2017;
- Tax and accounting obligations under applicable UK legislation;
- Obligations to respond to lawful requests from regulatory authorities, law enforcement, or courts.
iv. Consent — Article 6(1)(a) UK GDPR
Consent is used as a lawful basis only where no other basis is appropriate and where the conditions for valid consent under UK GDPR are met.
Bolttech relies on consent solely for the following purposes:
Marketing communications: At the conclusion of the insurance quotation journey in Phase 2, you will be asked whether you wish to receive marketing communications from Bolttech. If you consent, we may contact you by email, SMS, or telephone to inform you of products, promotions, or services that may be of interest to you.
Non-essential cookies and analytics: Where non-essential cookies or similar tracking technologies are placed on your device for analytics or personalization purposes, this is done on the basis of your prior consent in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR). Please refer to our Cookie Policy at https://bolttech.io/cookie-policy/ for further detail.
We may use your Personal Data to contact you via email, SMS or telephone (including mobile) if you have consented to us using your Personal Data for the purpose of marketing and providing you with promotional offers, discounts and information about any products or services we offer (you are free to withdraw this consent at any time).
You may withdraw any consent given to Bolttech at any time by contacting us at [email protected], by using the unsubscribe link in any marketing communication, or by adjusting your cookie preferences on the Platform. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
For the avoidance of doubt, Bolttech does not rely on the consent given by you to the Dealer as a lawful basis for any of its own processing activities. Bolttech's lawful bases are established independently as set out in this Section 4.
v. Criminal convictions data — Article 10 UK GDPR, read with Schedule 1, Part 1, paragraph 10 of the DPA 2018
The Insurance History data collected through the Platform includes motoring convictions in the last 5 years. This data constitutes personal data relating to criminal convictions and offences within the meaning of Article 10 UK GDPR.
The processing of this data is authorised under domestic law, specifically Schedule 1, Part 1, paragraph 10 of the Data Protection Act 2018 (the “Insurance” condition). This condition permits the processing of criminal convictions data where it is necessary for an insurance purpose, including advising on, arranging, underwriting, or administering an insurance contract.
Bolttech processes motoring convictions data for the following purposes:
- Generating an insurance quotation through the Platform;
- Transmitting the data to CCP and the insurer(s) to enable risk assessment and determination of the terms and premium of the policy;
- Assessment and management of insurance claims; and
- Detection and prevention of insurance fraud.
Bolttech maintains an Appropriate Policy Document in accordance with Schedule 1, Part 4 of the DPA 2018 in respect of this processing, which sets out the procedures in place to ensure compliance with the data protection principles. A copy of this document is available upon request by contacting [email protected].
5. Data Sharing and Recipients
Your personal data may be shared with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate safeguards:
CCP (Care Car Plan Limited) — Co-broker partner
CCP is Bolttech's co-broker partner and is responsible for placing the insurance contract with the insurer(s). CCP performs its own processing as an independent data controller.
Data is shared with CCP as follows:
- Phase 1: The data received from the Dealer is transmitted to CCP via API integration so that you can be redirected to CCP's systems if applicable;
- Phase 2: The full set of data collected on the Platform — including both the data received from the Dealer and the data you provided directly — is transmitted to CCP for the purpose of obtaining insurance quotations from the insurer(s).
CCP acts as an independent data controller for its own processing activities once data is received. Please refer to CCP's privacy notice for further details.
Insurance intermediary and insurer partners
To fulfil the insurance broking service, we can also share your personal data with other and our authorised intermediary and insurer partners, who use it to generate quotations and, where you choose to subscribe, to issue and administer your motor insurance policy. These partners act as independent data controllers for their own processing activities and have issued their own privacy notices. Details of the relevant partners will be identified in your quotation and policy documentation.
Service providers acting on our behalf
We engage third-party processors to support the operation of the Platform, including IT hosting, security monitoring, analytics, and customer support. All processors are subject to data processing agreements requiring them to process personal data only on our instructions and to maintain appropriate security measures.
Regulatory and public authorities
We may disclose personal data to the FCA, HMRC, law enforcement, or other public authorities where required by law or where necessary to prevent or investigate unlawful activity.
6. International Data Transfers
As a matter of principle, Bolttech processes your personal data within the European Economic Area (EEA) or the United Kingdom. Where a transfer of personal data to a country outside the EEA/UK is necessary, Bolttech ensures that an appropriate safeguard is in place, including:
- Adequacy decisions adopted by the European Commission or the UK Secretary of State;
- Standard Contractual Clauses in accordance with Article 46 UK GDPR; or
- Other appropriate safeguards as permitted under applicable law.
7. Data Retention
We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to any applicable legal, regulatory, or contractual retention requirements.
- Quotation data that did not result in a policy is retained for 30 (thirty) days from the date of the quotation request.
- Policy-related data is retained for the duration of the insurance relationship and for a minimum of 7 (seven) years thereafter, in line with FCA record-keeping requirements.
- Data processed for fraud prevention and security is retained only for as long as necessary for those purposes.
- Marketing data is retained until you withdraw your consent or opt out, whichever is earlier.
- Technical and log data is retained for 365 days and then deleted or anonymised.
When data is no longer required, it is securely deleted or anonymised.
8. Automated Decision-Making
Automated processing may be used to support preliminary risk assessments and fraud detection within the insurance quotation process. These processes do not produce decisions with legal or similarly significant effects on you without human oversight.
If you have questions about any automated processing that may affect you, please contact us using the details provided in Section 1.
9. Your Rights
Subject to applicable law, you have the following rights in relation to your personal data processed by Bolttech:
- Right of access: you may request a copy of the personal data we hold about you.
- Right to rectification: you may request that we correct inaccurate or incomplete personal data.
- Right to erasure: you may request that we delete your personal data in certain circumstances.
- Right to restriction of processing: you may request that we restrict the processing of your data in certain circumstances.
- Right to data portability: you may request that we provide your data in a structured, machine-readable format, where technically feasible.
- Right to object: you may object to processing based on legitimate interests; we will cease such processing unless we can demonstrate compelling legitimate grounds.
- Right to withdraw consent: where Bolttech relies on consent under Article 6(1)(a) as its lawful basis (marketing and optional cookies), you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
- Right to lodge a complaint: you have the right to lodge a complaint with the competent data protection supervisory authority. In the UK, this is the Information Commissioner's Office (ICO).
To exercise any of these rights in relation to Bolttech's processing, please contact us at: [email protected].
10. Security Standards
Bolttech applies appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or destruction, in accordance with applicable data protection legislation and industry best practices.
In the event of a personal data breach, Bolttech will take appropriate measures in accordance with applicable legal obligations, including notification to the ICO and, where required, to affected individuals.
11. Changes to This Privacy Notice
This Privacy Notice may be updated from time to time to reflect changes in applicable legal requirements or in our processing activities. Any material changes will be communicated through the Platform or by other appropriate means.
12. Cookies and Tracking Technologies
The Platform may use cookies and similar tracking technologies to ensure its proper functioning, to analyse usage patterns, and, where consent is given, for marketing or personalisation purposes.
For detailed information on the cookies used on the Platform and how to manage your preferences, please refer to our Cookie Policy at https://bolttech.io/cookie-policy/.