Privacy Notice

Key points

Yeti Engines Ltd is the controller responsible for personal information covered by this Privacy Notice.

This Notice applies principally to the Yeti Engines business-to-business marketing website, partner and provider enquiries, controlled demonstrations and related business communications.

It does not govern:

• Yeti Compare or a consumer insurance quote, comparison, retrieval or results journey;
• a white-label or co-branded consumer journey;
• a partner dashboard, client portal, production API or live software service;
• policy purchase, administration or claims handling; or
• personal information Yeti processes solely on another organisation's documented instructions.

Separate privacy information will apply to those activities before they are made available.

We do not sell personal information. Submitting a business enquiry does not, by itself, subscribe you to general marketing. Please do not send consumer quote data, policyholder information, claims information, pet medical information, credentials or live production data through the marketing Website.

For privacy requests or complaints, email privacy@yetiengines.com.

1. About this Privacy Notice

1.1 Scope

This Privacy Notice explains how Yeti Engines Ltd may collect, use, store, disclose and otherwise process personal information when you:

1. visit the Website;
2. contact us about a founding-partner pilot, referral, co-brand, white-label opportunity, provider integration or another commercial opportunity;
3. communicate with us as a publisher, pet brand, retailer, charity, insurer, broker, intermediary, technology provider, investor, supplier, adviser or other business contact;
4. request or receive access to a controlled demonstration, prototype, evaluation environment or non-production material;
5. expressly accept our Website Terms of Use, Evaluation Terms or another set of terms where an acceptance mechanism is provided;
6. attend a call, meeting, demonstration or event involving Yeti;
7. report a vulnerability or security concern;
8. make a complaint or exercise a data-protection right; or
9. otherwise interact with us in connection with the Website or a prospective business relationship.

1.2 Website covered

The Website covered by this Privacy Notice includes:

1. yetiengines.com;
2. any www or other canonical version of yetiengines.com;
3. any subdomain of yetiengines.com that links to this Notice; and
4. any replacement domain on which this Notice is published.

1.3 Activities covered

This Notice principally concerns:

1. the Yeti Engines marketing Website;
2. prospective publisher, provider, broker, insurer, integration, supplier and commercial relationships;
3. controlled non-production demonstrations and evaluations;
4. regulatory or commercial onboarding connected with a prospective relationship; and
5. related communications, record keeping, security and legal matters.

1.4 Activities not covered

This Notice does not govern personal information processed through:

1. Yeti Compare;
2. a consumer quote, comparison, retrieval or results journey;
3. a publisher-branded or white-label consumer journey;
4. a live partner dashboard, production API, client portal or software service;
5. an insurer's, broker's or other provider's website;
6. policy purchase, payment, administration or claims handling; or
7. another service where a separate privacy notice is displayed.

Those activities involve different information, purposes, recipients, retention requirements and regulatory responsibilities. Appropriate separate privacy information will be provided before any such activity is made available.

1.5 Processing for another organisation

Where Yeti processes personal information solely on the documented instructions of a publisher, insurer, broker, client or other organisation, Yeti may act as that organisation's processor.

In that situation:

1. the relevant organisation is normally responsible for deciding how and why the information is used;
2. its privacy notice will normally apply to the individual concerned; and
3. Yeti's processing will be governed by the applicable contract and data-processing terms.

1.6 Legal effect

This Privacy Notice provides information about our use of personal information. It does not create contractual rights beyond those provided by applicable law.

Nothing in this Notice limits any right or protection that cannot lawfully be limited.

2. Who we are

2.1 Controller

Yeti Engines Ltd is the controller responsible for the personal information described in this Privacy Notice.

Our details are:

Yeti Engines Ltd Company number: 17266550 Registered in: England and Wales

Registered office:

5 Ribblesdale Place Preston England PR1 8BZ

Yeti Engines Ltd (FRN 1061516) is an Appointed Representative of Innovative Risk Labs Ltd, which is authorised and regulated by the Financial Conduct Authority (FRN 609155).

General enquiries: our team Privacy requests and complaints: privacy@yetiengines.com Security reports: security@yetiengines.com

2.2 Definitions

In this Privacy Notice:

1. Yeti, we, us and our mean Yeti Engines Ltd;
2. personal information and personal data mean information relating to an identified or identifiable individual;
3. Principal means an authorised firm responsible for regulated activity carried on by Yeti as an appointed representative, where the relevant appointment is effective;
4. Group Company means a company that directly or indirectly controls, is controlled by, or is under common control with Yeti Engines Ltd, including Heyworth & Co Group Ltd; and
5. Website has the meaning given in section 1.2.

3. Personal information we may collect

3.1 General

The information we collect depends on how you interact with us and which Website functions are available at the relevant time.

3.2 Business contact and enquiry information

When you use the enquiry form on this website, the details you enter (your topic, name, company, work email address and message) are sent to Yeti and delivered to our team by email through an email-delivery service provider acting on our behalf. We use them to respond to and manage your enquiry. The form contents are not stored in your browser storage. To protect the form against automated abuse, we also process limited technical information, such as your IP address, the time of submission and the page you submitted from. If the form cannot be sent, it instead prepares an email draft in your browser, and we receive that enquiry only if you send it through your own email provider. The on-page product examples do not collect personal information or request live insurance quotations.

When you contact or communicate with us, we may collect:

1. your name;
2. your work email address;
3. a personal email address where you choose to use one;
4. your telephone number;
5. your job title, occupation or role;
6. the organisation you represent;
7. your organisation's website and business address;
8. your organisation type;
9. the nature of your organisation's audience, products, services or insurance activities;
10. information about a proposed referral, co-brand, white-label, integration, pilot, distribution or provider relationship;
11. approximate audience, traffic, conversion, commercial or timing information;
12. information about your current pet-insurance or comparison arrangements;
13. preferred commercial or technical model;
14. the content of correspondence, forms and messages;
15. documents, presentations or attachments you provide;
16. written notes relating to calls, meetings or demonstrations;
17. communication and marketing preferences; and
18. other information you choose to provide.

3.3 Commercial, integration and due-diligence information

Where discussions progress, we may collect or create information concerning:

1. commercial requirements and proposed terms;
2. projected or historic traffic, conversion, revenue or audience data;
3. brand, content, distribution and customer-journey requirements;
4. technical architecture, systems, APIs, security requirements and integration dependencies;
5. provider, insurer, broker, intermediary or publisher relationships;
6. regulatory status, permissions, operating model and compliance requirements;
7. conflicts, sanctions, fraud, financial-crime or reputational checks where appropriate;
8. security and supplier-assurance questionnaires;
9. meeting records, decisions, approvals and actions;
10. draft proposals, pilot plans, statements of work and contracts; and
11. information reasonably needed to assess, approve, structure or manage a prospective relationship.

Some of this information may be commercially confidential. It may also contain personal information relating to directors, employees, representatives, advisers or other business contacts.

3.4 Controlled demonstrations and evaluation access

Where we provide access to a controlled demonstration, prototype, preview, sandbox or evaluation environment, we may process:

1. your name and work contact details;
2. your organisation and role;
3. access invitations and authentication information;
4. the terms or confidentiality commitments you accepted;
5. the date, time, duration and source of access;
6. pages, materials, functions or resources viewed;
7. device, browser, IP address and security information;
8. actions taken within the environment;
9. feedback, questions and evaluation notes; and
10. records needed to detect misuse, protect intellectual property and administer access.

Unless we expressly agree otherwise in writing, controlled demonstrations and evaluation environments must use synthetic, test or anonymised information only.

3.5 Calls, meetings, demonstrations and transcription

We may process:

1. meeting invitations and attendance information;
2. call or meeting notes;
3. follow-up actions and decisions;
4. correspondence and documents shared during the meeting; and
5. audio, video or transcripts where recording or transcription is used.

Where a call or meeting is recorded or transcribed, we will provide additional notice at or before recording where required.

3.6 Technical and Website information

When you access the Website, we and our hosting, network, content-delivery, security or technical providers may process limited technical information, including:

1. your IP address;
2. the date and time of a request;
3. the page, resource or file requested;
4. the referring page or website;
5. browser type and version;
6. device type;
7. operating system;
8. approximate geographic information derived from an IP address;
9. HTTP request and response information;
10. diagnostic and error information;
11. security and bot-detection information;
12. consent or preference information where relevant; and
13. information used to identify unusual, malicious or automated traffic.

Technical information may be processed through hosting, network, firewall, content-delivery, diagnostic and security logs even where the Website does not place non-essential cookies on your device.

3.7 Analytics information

Where Website analytics are enabled, we may collect or receive information about Website use, including:

1. page views and approximate visitor numbers;
2. pages visited and general navigation paths;
3. referring websites or campaigns;
4. general geographic region;
5. browser, operating-system, device and screen information;
6. outbound-link activity;
7. file downloads;
8. interactions with selected Website elements; and
9. technical performance information.

We do not intend to configure Website analytics to collect:

1. names, email addresses or telephone numbers;
2. enquiry or correspondence contents;
3. form-field contents;
4. credentials or security secrets;
5. consumer quote or policy information;
6. acceptance-record identifiers; or
7. special-category or criminal-offence information.

If analytics are introduced, the provider, configuration, technologies used and available controls will be described in our Cookies & website technologies notice.

3.8Terms, acknowledgement and approval records

Where the Website or a controlled process asks you to accept or acknowledge terms, notices or restrictions, we may record:

1. the date and time;
2. the document, version and effective date;
3. the page, form, environment or function used;
4. the method of acceptance or acknowledgement;
5. confirmation that the relevant control was selected;
6. a related submission, invitation, request or audit reference;
7. the privacy information made available at that time; and
8. limited technical information reasonably required to demonstrate authenticity or integrity.

We do not create an individual acceptance record merely because someone browses the public Website. An individual record is created only where an express acceptance or acknowledgement mechanism is used.

3.9 Rights, complaints, regulatory and security information

Where you exercise a legal right, make a complaint, report a concern or become involved in a regulatory or security matter, we may collect:

1. your identity and contact details;
2. evidence of identity or authority;
3. details of the request, complaint, incident or report;
4. correspondence and supporting documents;
5. technical information and evidence;
6. investigation notes and internal decisions;
7. actions considered or taken;
8. information shared with or received from advisers, insurers, auditors, a Principal, regulators or authorities; and
9. the outcome and follow-up record.

3.10 Information received from other sources

We may receive limited personal information from:

1. a colleague or representative of your organisation;
2. a Group Company;
3. a publisher, pet brand, retailer, charity, insurer, broker, intermediary or technology provider;
4. a Principal or prospective Principal;
5. a client, supplier, referral source or professional adviser;
6. a publicly available business source;
7. a professional-networking service;
8. a security researcher; or
9. a person authorised to act on your behalf.

Where required, we will provide appropriate privacy information within the applicable period.

3.11 Information you should not send through the marketing Website

Unless we have specifically requested it and appropriate arrangements are in place, do not send us:

1. consumer or policyholder quote information;
2. insurance policy, payment or claims information;
3. pet medical records or detailed pet-health information linked to an owner;
4. names, contact details or other personal information concerning your customers, members or audience;
5. passwords, authentication credentials or private encryption keys;
6. payment-card information;
7. confidential source code;
8. live production-system access details;
9. special-category personal information;
10. criminal-offence information;
11. information subject to another person's confidentiality rights;
12. exploitable vulnerability details that should instead be sent through the security-reporting route; or
13. information that you are not authorised to disclose.

If this type of information is sent without being requested, we may restrict access to it, return it, securely delete it, move it to an appropriate controlled channel, or retain only what is reasonably necessary to deal with the communication, protect legal rights or comply with law.

4. How we use personal information

4.1 Purposes

We may use personal information to:

1. operate, maintain, secure and deliver the Website;
2. provide requested Website content and functionality;
3. understand, assess and respond to enquiries;
4. identify the organisation and representative contacting us;
5. assess whether a proposed partner, provider, pilot or integration opportunity is suitable;
6. arrange calls, meetings, demonstrations and evaluations;
7. prepare proposals, pilot plans, estimates and commercial terms;
8. conduct proportionate commercial, technical, security, conflict, fraud, sanctions, financial-crime, regulatory and reputational checks;
9. determine the proposed operating and regulatory model for a relationship;
10. seek or support Principal, insurer, broker, intermediary, compliance or other approvals;
11. communicate with prospective, current and former partners, providers, suppliers, advisers and business contacts;
12. manage prospective and existing business relationships;
13. follow up on enquiries, meetings and previous discussions;
14. administer controlled demonstration or evaluation access;
15. record and demonstrate acceptance of Website Terms, Evaluation Terms, confidentiality obligations or other terms;
16. maintain contractual, commercial, operational, regulatory, accounting and legal records;
17. manage financial-promotion, compliance, audit or oversight processes where applicable;
18. understand Website use and performance;
19. improve the Website, proposition, materials and user experience;
20. identify and investigate errors, misuse, fraud, security threats and prohibited activity;
21. investigate vulnerability and security reports;
22. prevent unwanted, duplicate, abusive or fraudulent communications;
23. maintain suppression or do-not-contact records;
24. respond to data-protection requests and complaints;
25. establish, exercise or defend legal rights;
26. comply with legal, regulatory, accounting, tax, insurance and corporate requirements;

aa. manage an investment, funding, business sale, restructuring or transfer;

ab. protect Yeti, Group Companies, prospective and current partners, providers, suppliers and Website visitors;

ac. send relevant business communications where permitted by law; and

ad. carry out other purposes reasonably compatible with those described above.

4.2 No sale of personal information

We do not sell personal information or trade it as a commodity.

4.3 No consumer insurance decisions through this Website

Personal information collected through the marketing Website is not used to:

1. calculate a consumer insurance premium;
2. determine consumer eligibility for an insurance policy;
3. rank or personalise consumer insurance results;
4. make a claims decision; or
5. make another solely automated decision producing legal or similarly significant effects for a consumer.

Separate privacy information will apply before a consumer quote or comparison service processes personal information.

4.4 Enquiry sharing

We do not ordinarily disclose the substantive contents of a first-contact enquiry to an unrelated publisher, insurer, broker, intermediary or commercial partner unless:

1. you authorise the disclosure;
2. the proposed disclosure is apparent from your request and appropriate information is provided beforehand;
3. the information is anonymised or aggregated so that it no longer identifies you; or
4. disclosure is required or permitted by law, regulation or a valid oversight requirement.

5. Our lawful bases

5.1 General

We must have a lawful basis for processing personal information. The basis used depends on the information, circumstances and purpose.

The lawful bases available under current UK data-protection law include consent, contract, legal obligation, vital interests, public task, recognised legitimate interests and legitimate interests.

5.2 Lawful-basis summary

5.3 Legitimate interests

Relevant legitimate interests may include:

1. operating, maintaining, securing and improving the Website;
2. responding to enquiries and discussing prospective opportunities;
3. assessing, developing and managing commercial relationships;
4. protecting confidential information, systems and intellectual property;
5. administering controlled demonstrations and evaluation environments;
6. conducting proportionate due diligence;
7. maintaining an accurate relationship and decision history;
8. recording express acceptance of terms and notices;
9. preventing duplicate, unwanted, abusive or fraudulent communications;
10. detecting fraud, misuse and security incidents;
11. meeting insurer, broker, publisher, Principal and supplier due-diligence expectations;
12. resolving complaints and disputes;
13. establishing, exercising and defending legal rights; and
14. sending relevant business-to-business communications where permitted.

Where appropriate, we consider the purpose and necessity of the processing, the nature of the information, what an individual may reasonably expect, possible effects on the individual and available safeguards.

5.4 Steps before entering into a contract

We may process information where necessary to take steps at your request before entering into a contract, including where you ask us to:

1. assess a proposed relationship or integration;
2. provide information about Yeti Engines;
3. arrange a meeting or demonstration;
4. provide access to evaluation materials;
5. prepare a proposal, pilot plan or estimate; or
6. discuss possible contractual or commercial terms.

5.5 Contract

Where you contract with us as an individual, we may process information where necessary to perform or administer that contract.

Where the contract is with your employer, company or another organisation, we will generally rely on legitimate interests or another appropriate lawful basis when processing your business contact information.

5.6 Legal obligations

We may process personal information where necessary to comply with legal or regulatory obligations concerning matters such as:

1. data protection;
2. tax, accounting and corporate administration;
3. financial promotions and regulatory oversight;
4. court or tribunal proceedings;
5. regulator, law-enforcement or public-authority requests;
6. fraud, sanctions and financial crime; and
7. legally required records.

5.7 Consent

We may rely on consent where this is appropriate or legally required.

Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before consent was withdrawn and does not prevent processing under another lawful basis where one applies.

5.8 Recognised legitimate interests

Where permitted by applicable data-protection law, we may rely on a recognised legitimate interest for processing that falls within one of the purposes specified by law, such as certain fraud-prevention, safeguarding, emergency or public-task-related disclosures.

5.9 Vital interests

We may process personal information where necessary to protect the vital interests of an individual or another natural person, for example in a genuine emergency involving a risk to life. We expect this basis to apply only in exceptional circumstances.

5.10 Public task

We may process personal information where necessary for the performance of a task carried out in the public interest or in the exercise of official authority, where that task or authority has a clear basis in law. We do not currently expect this to be a routine basis for processing through this Website, but it may apply in specific circumstances.

6. Business communications and direct marketing

6.1 Enquiry-related communications

We may contact you about:

1. an enquiry you have made;
2. a proposed pilot, partnership, integration or provider relationship;
3. a current, prospective or previous business relationship;
4. matters reasonably connected with your organisation; or
5. another matter where contact is permitted by law.

6.2 No automatic marketing subscription

Submitting a Website enquiry does not, by itself, subscribe you to general marketing communications.

We may send communications directly related to your enquiry, requested demonstration, proposed opportunity or existing relationship.

We will send broader promotional updates only where:

1. you have made a separate marketing choice;
2. an applicable business-to-business marketing rule permits the communication; or
3. another lawful and fair basis applies.

6.3 Electronic marketing

For business-to-business electronic marketing, the rules may differ depending on whether the recipient is:

1. a corporate subscriber, such as a limited company; or
2. an individual subscriber, such as a sole trader or certain partnerships.

Where consent or the soft opt-in is required, we will rely on it only where the relevant conditions are met.

Electronic marketing will include a practical way to opt out where required.

6.4 Objections and suppression

You may object to direct marketing at any time.

Where a valid objection is received, we may retain limited information on a suppression list so that the objection continues to be respected.

7. Website infrastructure, analytics and cookies

7.1 Website delivery and security

We may use cloud hosting, application hosting, content-delivery, domain, networking, firewall, bot-management, monitoring and security providers to deliver and protect the Website.

These providers may process technical information such as IP addresses, request details, device information, security signals, diagnostics and logs.

The production Website may use infrastructure in the United Kingdom together with global edge, security or software-as-a-service providers. Relevant international-transfer safeguards are described in section 10.

7.2 Website analytics

No optional analytics or advertising scripts are currently installed on this marketing website. The Cookies & website technologies notice describes the current implementation.

We may use privacy-focused Website analytics to understand general Website use, traffic sources, content performance and visitor journeys.

We would not deliberately configure any analytics service to receive enquiry contents, form-field values, credentials, consumer quote information or other unnecessary identifying information.

If analytics are introduced, the provider, configuration, retention period, technologies used and available controls will be described in our Cookies & website technologies notice.

7.3Cookies and similar technologies

The Website may use cookies, browser storage, scripts, tags or similar technologies where necessary or appropriate to:

1. deliver pages or requested functionality;
2. maintain security;
3. manage traffic;
4. remember a choice requested by a visitor;
5. prevent misuse;
6. measure Website use and performance; or
7. provide another Website function.

Where consent or another user control is required, the relevant technology will be handled through an appropriate consent or preference mechanism.

7.4 Advertising and cross-site tracking

At the effective date of this Notice, the Website does not use advertising pixels, cross-site behavioural advertising or remarketing technologies.

We will update the Cookies & website technologies notice and implement any legally required consent controls before introducing those technologies.

8. Who we may share information with

8.1 General

We may share personal information only where reasonably necessary and where an appropriate lawful basis applies.

8.2 Hosting, infrastructure, security and analytics providers

We may share or permit processing by providers of:

1. cloud and application hosting;
2. content delivery, domain and network services;
3. web application firewall, bot management and security;
4. monitoring, error reporting and diagnostic services;
5. backups and business continuity;
6. Website analytics and measurement; and
7. related technical services required to operate and protect the Website.

8.3 Communication and operational providers

We may use providers of:

1. business email;
2. calendars, video meetings and transcription;
3. cloud storage and document management;
4. project and task management;
5. customer or business relationship management;
6. electronic signatures and terms-acceptance records;
7. security and supplier-assurance systems;
8. professional communications; and
9. general business administration.

8.4 Group Companies

We may share information with Heyworth & Co Group Ltd, Yeti Digital Ltd or another Group Company where reasonably necessary to:

1. administer the group;
2. respond to an enquiry relating to a Group Company, product or service;
3. provide technical, operational, administrative or security support;
4. develop, demonstrate, maintain or support the Website or Platform;
5. manage intellectual property;
6. protect legal rights;
7. manage financial or corporate affairs; or
8. complete an investment, restructuring or business transaction.

A Group Company may act:

1. as Yeti's processor where it handles information only on Yeti's documented instructions; or
2. as a separate controller where it determines its own purposes and methods of processing.

8.5 Principal, regulatory and compliance recipients

Where relevant to onboarding, approval, oversight, financial promotions, audit, complaints, regulatory reporting or legal obligations, we may share information with:

1. Innovative Risk Labs Ltd, our current Principal;
2. the Principal's employees, compliance personnel, auditors, consultants or professional advisers;
3. the Financial Conduct Authority or another regulator;
4. an insurer, broker, intermediary or capacity provider involved in an approved operating model; and
5. another person whose review or approval is reasonably required for the proposed activity.

Where Yeti Engines Ltd and Innovative Risk Labs Ltd each determine their own purposes and methods of processing, each acts as an independent controller and Innovative Risk Labs Ltd's own privacy information applies to its processing.

8.6 Publishers, insurers, brokers and commercial counterparties

We may share relevant business contact or opportunity information with a prospective or actual publisher, insurer, broker, intermediary, technology provider or other counterparty where:

1. the disclosure is necessary to assess, structure, approve or perform a proposed relationship;
2. you have authorised it;
3. the proposed sharing has been explained or is reasonably apparent in context;
4. the information is anonymised or aggregated; or
5. disclosure is required or permitted by law or regulation.

We will not ordinarily forward the full contents of an unsolicited first-contact enquiry to an unrelated commercial counterparty merely because it may be interested.

8.7 Professional advisers, consultants and insurers

We may share information with solicitors, barristers, accountants, auditors, insurers, brokers, tax advisers, regulatory advisers, data-protection advisers, technical consultants and other professional advisers.

8.8 Authorities and legal recipients

We may disclose information to courts, tribunals, regulators, law-enforcement bodies, tax authorities, public authorities, insolvency practitioners and other persons where disclosure is required or permitted by law.

8.9 Business transactions

We may share information with prospective or actual purchasers, investors, funders, lenders, transaction advisers, counterparties or successors in connection with an investment, sale, acquisition, merger, restructuring, financing, insolvency process or transfer of assets or business operations.

We will seek to limit disclosure to what is reasonably necessary and use confidentiality or other safeguards where appropriate.

9. Separate controllers and third-party privacy notices

9.1 Independent controllers

A Principal, insurer, broker, publisher, professional adviser, regulator or other recipient may act as an independent controller where it determines how and why it uses personal information.

Its own privacy notice and legal responsibilities apply to that processing.

9.2 Insurer and provider websites

If a person later uses Yeti Compare or continues to an insurer's, broker's or provider's website, separate privacy information will explain:

1. which organisations receive the consumer's information;
2. the purposes and lawful bases;
3. whether information is used for pricing, eligibility, fraud prevention or policy administration;
4. retention periods;
5. international transfers; and
6. the individual's rights and complaint routes.

This marketing Website Privacy Notice does not replace that information.

10. International transfers

10.1 General

Some service providers, Group Companies, professional advisers or commercial counterparties may process personal information outside the United Kingdom.

Global edge, security, email, meeting, analytics, monitoring and other cloud services may involve processing in multiple jurisdictions.

10.2 Safeguards

Where rules concerning restricted international transfers apply, we will use or rely on an appropriate legal mechanism.

Depending on the provider and circumstances, this may include:

1. UK adequacy regulations;
2. the UK Extension to the EU-US Data Privacy Framework where the recipient participates;
3. the UK International Data Transfer Agreement;
4. the UK Addendum to approved standard contractual clauses;
5. approved standard contractual clauses;
6. another recognised transfer framework; or
7. another mechanism permitted by law.

We may carry out transfer assessments, review provider terms and implement additional contractual, technical or organisational safeguards where required.

You may contact us for further information about safeguards applying to a particular category of transfer.

11. How long we retain personal information

11.1 General approach

We keep personal information only for as long as reasonably required for the relevant purpose, subject to legal, contractual, regulatory, accounting, security and claims-related requirements.

11.2 Normal retention periods

11.3 Exceptions

We may retain information for longer where reasonably necessary because:

1. a complaint, dispute, investigation or legal claim exists or is reasonably anticipated;
2. a legal or regulatory hold applies;
3. law, regulation, a Principal, an insurer, insurance requirements or a binding contractual obligation requires it;
4. the information is relevant to fraud, sanctions, misuse, security or the protection of systems and legal rights; or
5. deletion is temporarily impracticable because information is held in a secure backup or archive.

11.4 Deletion, anonymisation and backups

When identifiable information is no longer reasonably required, it may be:

1. deleted;
2. anonymised;
3. aggregated;
4. securely archived with restricted access; or
5. allowed to expire through ordinary system, archive or backup cycles.

Backup information is not ordinarily restored except for business continuity, disaster recovery, security or technical necessity. Where restored, applicable deletion and restriction decisions will be reapplied where reasonably practicable.

11.5 Erasure requests

You may ask us to erase personal information.

The right to erasure is not absolute. We may retain information where a lawful basis or other lawful reason remains, including:

1. legal or regulatory obligations;
2. tax, accounting, corporate or insurance requirements;
3. the rights of another person;
4. freedom of expression and information; or
5. the establishment, exercise or defence of legal claims.

12. Security

12.1 Measures

We use organisational and technical measures intended to protect personal information against:

1. unauthorised access;
2. accidental loss;
3. misuse;
4. alteration;
5. inappropriate disclosure; and
6. destruction.

The measures used depend on the nature of the information, systems involved, likelihood and severity of the risk, available technology and proportionality.

Measures may include:

1. access restrictions and least-privilege controls;
2. authentication and multi-factor authentication;
3. encryption in transit;
4. infrastructure and supplier controls;
5. software and dependency updates;
6. firewall, rate-limiting and bot-management controls;
7. security and administrative logging;
8. backups and recovery arrangements;
9. confidentiality obligations;
10. vulnerability management;
11. environment separation and use of synthetic data in non-production systems; and
12. incident-response arrangements.

12.2 Data minimisation

We seek to minimise the personal information included in:

1. Website analytics;
2. technical logs;
3. security telemetry;
4. demonstrations and test environments;
5. business presentations; and
6. development and support materials.

12.3 No absolute guarantee

No internet service, system or electronic communication can be guaranteed to be completely secure.

You are responsible for choosing an appropriate method when sending sensitive or confidential information to us.

12.4 Security reports

Security concerns should be sent to security@yetiengines.com.

Please do not include unnecessary personal information, credentials, live consumer information or destructive exploit activity in an initial report.

13. Automated decision-making and artificial intelligence

13.1 No solely automated significant decisions

We do not currently use personal information collected through the marketing Website to make decisions producing legal or similarly significant effects through solely automated processing.

13.2 Security and spam controls

We may use automated tools to:

1. detect spam, bots, malware and abusive traffic;
2. identify security anomalies;
3. prioritise technical alerts; and
4. protect the Website and controlled environments.

These activities do not ordinarily produce legal or similarly significant effects for an individual.

13.3 Artificial-intelligence use

We do not intentionally use personal information submitted through the Website to train general-purpose artificial-intelligence models.

Where an approved AI-assisted or transcription tool is used for business administration, meeting support, drafting or summarisation, we will:

1. use it only where a lawful basis applies;
2. minimise the personal and confidential information provided;
3. apply appropriate supplier and access controls; and
4. provide additional notice where required.

Live consumer quote data, policyholder data, credentials and production secrets must not be submitted to general-purpose AI tools through this Website process.

14. Your data-protection rights

14.1 Rights

Depending on the circumstances, processing and lawful basis used, you may have the right to:

1. ask whether we process your personal information;
2. obtain a copy of personal information we hold about you;
3. correct inaccurate or incomplete information;
4. ask us to erase personal information;
5. ask us to restrict processing;
6. object to processing;
7. receive certain information in a portable format;
8. withdraw consent where processing is based on consent; and
9. complain about how personal information has been handled.

These rights are subject to legal conditions, limitations and exemptions.

14.2 Identity and scope

We may request information reasonably required to:

1. verify your identity;
2. confirm your authority to act for another person;
3. identify the information concerned; or
4. clarify the scope of a request.

We will not request more information than is reasonably necessary.

14.3 Fees

We do not ordinarily charge a fee.

A reasonable fee may be charged, or a request may be refused, where permitted by law, including where a request is manifestly unfounded or excessive.

14.4 Response times

We respond to rights requests within the periods required by applicable data-protection law.

The usual period is one month after receiving the request and any information reasonably required to confirm identity or authority.

Where permitted by law, the period may be extended by up to two further months where a request is complex or a person has made a number of requests. Where an extension applies, we will provide information about it within the initial statutory period.

14.5 Right to object

You have the right to object where we process personal information on the basis of legitimate interests.

This right is subject to the applicable legal test. Processing may continue where there are compelling legitimate grounds that override your interests, rights and freedoms, or where processing is required to establish, exercise or defend legal claims.

You may object to direct marketing at any time.

Where a valid direct-marketing objection is received, we may retain limited information on a suppression list to ensure that the objection continues to be respected.

14.6 How to exercise a right

Email privacy@yetiengines.com using the subject line Data Protection Request.

You may also write to the postal address in section 20.

15. Data-protection complaints

15.1 How to complain

You may make a data-protection complaint by:

1. emailing privacy@yetiengines.com using the subject line Data Protection Complaint;
2. using our complaints route; or
3. writing to the postal address in section 20.

A complaint may be made through another channel. We will not refuse to consider a complaint solely because it was not submitted using the suggested route.

15.2 Helpful information

It is helpful, but not mandatory, to provide:

1. your name and contact details;
2. a description of the concern;
3. relevant dates or communications;
4. the outcome you are seeking; and
5. supporting information.

15.3 Our process

We will:

1. acknowledge receipt within 30 days;
2. take appropriate steps to investigate without undue delay;
3. keep you appropriately informed where required; and
4. communicate the outcome without undue delay.

We may request further information or evidence of identity or authority where reasonably necessary.

15.4 Information Commissioner's Office

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection and information rights.

Information about making a complaint is available on the ICO website.

You are not required to complete Yeti's complaints process before contacting the ICO, although raising the matter with us first may allow it to be resolved more quickly.

16. Insurance and regulated complaints

16.1 Separate route

A complaint about a consumer insurance quote, comparison journey, provider hand-off, insurance distribution activity, policy or claim is not a data-protection complaint merely because it concerns information about an individual.

Where relevant, those complaints must be made through our applicable consumer or regulated complaints route.

16.2 Principal involvement

Where a complaint concerns activity carried on under a Principal's responsibility, we may need to:

1. notify the Principal;
2. share relevant complaint and customer information;
3. obtain further information;
4. cooperate with the Principal's investigation; and
5. retain the record for the applicable regulatory period.

The applicable consumer privacy notice and complaints information will explain the relevant arrangements before a regulated consumer service goes live.

17. Children

The Website is principally intended for businesses and professional users and is not directed at children.

We do not intentionally seek to collect personal information from children through the Website.

If we become aware that personal information concerning a child has been provided in circumstances where it should not have been, we may investigate and take appropriate action.

18. Third-party websites and services

The Website may contain links to websites, products, platforms or services operated by other organisations.

Those organisations are responsible for their own privacy practices where they determine how and why personal information is processed.

This Privacy Notice does not govern personal information collected independently by another organisation. You should review the relevant third party's privacy information where appropriate.

19. Changes to this Privacy Notice

We may update this Privacy Notice where:

1. the Website changes;
2. a service, demonstration, provider or technology is introduced or removed;
3. a supplier changes;
4. our processing activities change;
5. a regulatory appointment or operating model changes;
6. the law, regulation or regulatory guidance changes;
7. our business or Group structure changes; or
8. clarification is considered appropriate.

The current version will be identified by its version number, effective date and last-updated date.

Changes apply from the effective date stated in the updated Notice.

Where required, additional privacy information will be provided before personal information is used for a materially different purpose.

Separate privacy information will be provided before Yeti Compare, a consumer quote journey or another live regulated consumer service processes personal information.

20. Contact us

Questions, requests and complaints concerning this Privacy Notice or our use of personal information may be sent to:

Privacy requests and complaints: privacy@yetiengines.com
General enquiries: our team
Security reports: security@yetiengines.com

Suggested subject lines:

• Data Protection
• Data Protection Request
• Data Protection Complaint
• Security Report

Post:

Yeti Engines Ltd
5 Ribblesdale Place
Preston
England
PR1 8BZ

Postal correspondence may be marked for the attention of the directors.