Security and data
Last updated October 2026
In short: we sign a data processing agreement before we touch any client data, we use only what the reminders need, nothing is sent at launch without your approval, every message is logged, and your data is returned or deleted when the work ends.
Our role
Under UK GDPR, your firm remains the controller of your clients’ personal data. Ellisons acts as your processor: we only use that data on your written instructions, which are set out in a data processing agreement signed before work starts.
What data we use
The renewal assistant needs a regular export of your upcoming renewals containing:
- the client’s business name and the contact’s name and email address
- the policy type and renewal date
- the account handler the reminder should come from
We don’t need bank details, claims histories, or any special category or criminal offence data, and we ask you to leave anything beyond the list above out of the export.
Mailbox access
Reminders are sent from your firm’s mailbox so clients see a name they know. We agree the scope of that access with you in week 1, use it only for renewal reminders and the replies to them, and you can remove it at any time.
Where data is stored and which AI is used
Your renewal data is stored with [[HOSTING PROVIDER AND REGION]]. Reminders are drafted using [[AI PROVIDER]]. [[STATE THE AI PROVIDER’S DATA-USE TERMS HERE, FOR EXAMPLE WHETHER BUSINESS DATA IS USED FOR MODEL TRAINING AND HOW LONG IT IS RETAINED]].
Human approval
- During the shadow test, the assistant runs on real renewals and sends nothing.
- At launch, every email is approved by you or your team before it goes.
- Auto-send for routine reminders is optional, is only switched on with your agreement, and can be switched off at any time.
Record of every contact
Each message is logged with its date, the wording sent, the recipient and who approved it. You can export the log at any time, for example as evidence of how you contacted customers at renewal.
Who can access your data
Access is limited to [[YOUR NAME]]. Every account that holds your data is protected with multi-factor authentication.
If something goes wrong
If we become aware of a personal data breach affecting your data, we’ll tell you without undue delay, explain what happened and what we’re doing about it, and help you meet your own reporting obligations.
When the work ends
Whether the pilot stops at day 60 or you end the service later, we return or delete your data within 30 days and confirm in writing once it’s done.
Registration and contact
[[REGISTERED COMPANY NAME]] is registered with the Information Commissioner’s Office, number [[ICO NUMBER]].
Questions about security or data? Email [[EMAIL]] and we’ll answer them before you sign anything.