Privacy Policy

Costa Claims is a trading style of Halero Limited. Halero Limited is the data controller responsible for the personal information covered by this policy.

This policy explains how we handle information when you visit our website, make an enquiry or use our services. We process personal information in accordance with applicable data protection law, including the UK Data Protection Act 2018, the UK GDPR and the EU GDPR where applicable.

The information we request depends on your enquiry and the services you need. It may include:

• Contact and identity details, such as your name, email, telephone number, address and NIE or other identification information.
• Mortgage and financial information, including your lender, the year your mortgage was taken out, relevant financial products and documents relating to a potential claim.
• Your signature, the terms you accept and records of your enquiry, correspondence and claim progress.
• When you submit your signed claim, we record the submission time in UTC and your IP address, where available, alongside your signed document to maintain evidence of signing and help prevent fraud. An IP address alone does not prove identity.
• Technical and usage information, such as IP address, browser, device details and information about visits to our website, where collected.
• Communication preferences and any consent you give for marketing or information sharing.

If you provide sensitive information, such as health information, we only process it where an appropriate legal condition applies, such as your explicit consent or a legal obligation. Please do not send sensitive information that is not needed for your enquiry.

You may give us information through website or social media forms, or when contacting us by telephone, email, post or other means. We may also receive information from service partners where there is a lawful basis for doing so. Where calls are recorded, you will be informed as appropriate.

We use personal information to assess enquiries, communicate with you, provide the services you request and manage potential claims. We may also use it to maintain records, deal with complaints, prevent fraud, obtain professional advice, comply with legal requirements and improve our services.

• Contract: to provide an agreed service or take steps you request before entering into an agreement.
• Legal obligation: to meet applicable legal, accounting or regulatory requirements.
• Legitimate interests: for necessary business activities, provided those interests do not override your rights and freedoms.
• Consent: where we ask for your permission, including where required for marketing or sharing information.

Where we rely on consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before you withdrew it.

Where necessary to assess or progress your enquiry, information may be shared with claims management partners, solicitors or law firms. If you instruct a separate firm to act for you, that firm may become an independent data controller and will explain its handling of your information in its own privacy notice.

We may use suppliers to help deliver our services, including hosting, administration and communications providers. Providers acting as data processors must handle information under appropriate contractual instructions and safeguards.

Information may also be shared with insurers, professional advisers or relevant authorities where necessary for legal obligations, professional advice, the protection of rights or the establishment, exercise or defence of legal claims. Sharing for a third party's own marketing requires an appropriate lawful basis and consent where required.

If information is transferred outside the UK or European Economic Area, the applicable legal requirements and appropriate transfer safeguards must be met.

Where permitted by law, we may contact you about relevant services. Electronic marketing is subject to applicable consent and opt-out requirements; we do not treat submitting a claim enquiry as blanket consent to unrelated marketing.

You can ask us to stop direct marketing at any time using the contact details below or an unsubscribe option included in a message. Necessary communications about your enquiry or service may still be sent.

We keep information only for as long as it is needed for its purpose, taking account of the progress of your enquiry, legal and regulatory requirements, accounting obligations and the need to resolve complaints or legal claims.

Retention periods vary by record type and circumstances. You can contact Halero Limited for information about the retention period applying to your records. Information that is no longer needed should be securely deleted or anonymised.

Depending on the circumstances and applicable law, you may have the right to:

• Be informed about how your information is used and request access to it.
• Correct inaccurate or incomplete personal information.
• Request deletion of your information or restrict its use.
• Receive certain information in a portable format.
• Object to processing, including direct marketing.
• Withdraw consent and exercise rights relating to solely automated decisions with significant effects, where applicable.

Contact us to exercise your rights. We may need to verify your identity. We normally respond within one month, subject to extensions and exceptions allowed by law. Requests are generally free; a lawful fee or refusal may apply to manifestly unfounded or excessive requests.

We use appropriate organisational and technical measures to protect personal information against unauthorised access, loss and misuse. No online transmission or storage system can be guaranteed completely secure. Keep any account password confidential.

Links to external websites are provided for convenience. Those websites have their own privacy practices, which you should review before providing information.

Please contact Halero Limited using the details below if you have questions, want to exercise a privacy right or wish to complain about how your information is handled. We will consider your concerns and respond in accordance with applicable requirements.

You also have the right to complain to a relevant data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In Spain you can contact the Agencia Española de Protección de Datos (aepd.es). You do not have to contact us before raising a complaint with an authority.

This policy may be updated when our services or applicable requirements change. The latest version will be available on this page.