Privacy Notice
Last updated: June 2026
Introduction
This Privacy Notice explains how Ancep Ltd (“Ancep”, “we”, “us”, “our”) collects and uses personal data when you visit our website, when you use the Ancep Service as an authorised user, or when your personal data is processed by the Ancep Service on behalf of one of our business customers.
If you have any questions about this Notice or wish to exercise your rights, contact us at team@ancep.com or submit a request via our privacy request form.
1. Who We Are
1.1
Ancep Ltd is a company registered in England and Wales. We operate the Ancep Service, an AI-native operations platform for the insurance sector.
1.2
For the purposes of UK and EU data protection law, Ancep is the “controller” of personal data described in sections 3.1 and 3.2 below. For personal data uploaded to the Ancep Service by our business customers, we act as a “processor” on those customers’ behalf; see section 2.3.
2. Who This Notice Applies To
2.1
Website visitors. If you browse ancep.com, request a demo, or otherwise interact with our public website, this Notice tells you what we collect about you.
2.2
Authorised users of the Ancep Service. If you log in to the Ancep Service as an employee or contractor of one of our business customers, this Notice tells you what we collect about you in that capacity. Your employer (our customer) is the controller of any data you submit through the Service; we process it on their behalf.
2.3
End individuals whose personal data is processed through the Ancep Service. Our business customers use the Ancep Service to process personal data about third parties (for example, individuals named in insurance submissions, communications, or attachments). For that data, Ancep acts as a processor; the relevant Ancep customer is the controller and is responsible for telling you how it uses your data. If you wish to exercise your rights in respect of that data, you should contact the Ancep customer directly. We will assist them as required.
3. Personal Data We Collect
3.1
From website visitors:
(a)
Information you provide when you contact us or request a demo (name, email address, company, role, message content).
(b)
Technical data collected automatically when you visit the website (IP address, browser type and version, device information, pages viewed, referrer, timestamps).
(c)
Cookie and similar identifier data, where you have consented or where strictly necessary. See section 12.
3.2
From authorised users of the Ancep Service:
(a)
Account and identity information (name, email address, role, organisation), provided by you or by your employer.
(b)
Authentication data (login credentials and session tokens), managed via our identity provider.
(c)
Usage and log data describing how you interact with the Ancep Service (pages viewed, actions taken, timestamps, IP address, device data).
(d)
Support and communication content if you contact us for help.
3.3
From end individuals (processor role). The categories of personal data we process on behalf of our business customers are described in Schedule 1 of our Data Processing Addendum at ancep.com/data. The relevant Ancep customer determines what data is uploaded and is the controller of that data.
4. How We Use Your Personal Data
4.1
Website visitors. We use your personal data to:
(a)
operate and secure our website;
(b)
respond to your enquiries and demo requests;
(c)
understand how the website is used so we can improve it;
(d)
send you marketing communications, where you have consented or where permitted on a soft opt-in basis. You can unsubscribe at any time.
4.2
Authorised users of the Ancep Service. We use your personal data to:
(a)
provide, secure and support the Ancep Service to you and your employer;
(b)
authenticate you and manage your account;
(c)
monitor and improve the performance and reliability of the Ancep Service;
(d)
comply with our legal and regulatory obligations.
4.3
End individuals. We only process this data on the instructions of the relevant Ancep customer and in accordance with our Data Processing Addendum at ancep.com/data.
5. Lawful Basis for Processing
5.1
Where Ancep is the controller, the lawful bases we rely on under Article 6 of the UK and EU GDPR are:
(a)
Contract — where processing is necessary to provide the Ancep Service to you or to your employer under a contract.
(b)
Legitimate interests — for operating, securing, monitoring and improving our website and the Ancep Service, and for responding to enquiries. We have balanced these interests against your rights and consider them not to be overridden.
(c)
Consent — for non-essential cookies and certain marketing communications. You can withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
(d)
Legal obligation — where we are required by law to retain or disclose personal data.
6. Who We Share Personal Data With
6.1
We share personal data with service providers that help us run the website and the Ancep Service. The list of sub-processors we use to deliver the Ancep Service is published in Schedule 3 of our Data Processing Addendum at ancep.com/data.
6.2
We may also disclose personal data:
(a)
to professional advisers (lawyers, accountants, auditors) under duties of confidentiality;
(b)
to a buyer or successor entity in connection with a corporate transaction such as a merger, acquisition or sale of assets;
(c)
where required to comply with law, legal process, or a lawful request from a public authority.
7. International Transfers
7.1
The Ancep Service is hosted in the United Kingdom by default, with EU and US hosting available where data residency requires.
7.2
Some of our sub-processors are based outside the UK or EEA. Where personal data is transferred to a country that is not subject to a UK or EU adequacy decision, we rely on appropriate safeguards (including the UK International Data Transfer Addendum and the EU Standard Contractual Clauses) as described in clause 13 of our Data Processing Addendum.
8. How Long We Keep Personal Data
8.1
We keep personal data only for as long as is necessary for the purposes set out above, and to comply with our legal, accounting or reporting obligations.
8.2
In general:
(a)
Website enquiries are retained for up to 24 months after our last contact with you, unless a longer period is required for an ongoing relationship.
(b)
Authorised user account data is retained for the duration of your access to the Ancep Service and for a limited period afterwards as necessary for security, audit and legal purposes.
(c)
Server and application logs are retained for up to 13 months.
(d)
Data processed on behalf of customers is retained in accordance with clause 12 of the Data Processing Addendum.
9. Security
9.1
We maintain technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure, including encryption in transit and at rest, access controls, logical segregation of customer data, audit logging, and regular security review. Further detail is set out in our Data Processing Addendum and on our Security page.
9.2
If we become aware of a security incident affecting your personal data, we will notify you and (where applicable) the relevant supervisory authority in accordance with our legal obligations.
10. Your Rights
10.1
Subject to applicable law, you have the following rights in respect of personal data for which Ancep is the controller:
(a)
Access — to obtain a copy of the personal data we hold about you.
(b)
Rectification — to ask us to correct inaccurate or incomplete personal data.
(c)
Erasure — to ask us to delete personal data in certain circumstances.
(d)
Restriction — to ask us to restrict processing in certain circumstances.
(e)
Portability — to receive personal data you provided to us in a structured, commonly used, machine-readable format, and to ask us to transmit it to another controller.
(f)
Objection — to object to processing based on our legitimate interests, including direct marketing.
(g)
Withdraw consent — where we rely on consent, you can withdraw it at any time.
10.2
If your personal data is processed by the Ancep Service on behalf of one of our business customers, you should direct your request to that customer. We will assist them to respond in accordance with our contractual obligations.
11. How to Exercise Your Rights
11.1
To exercise any of the rights above, submit a request via our privacy request form or email team@ancep.com.
11.2
We will acknowledge your request within five business days and respond within one month of receipt. We may extend this period by a further two months for complex or numerous requests, in which case we will tell you within the first month and explain why.
11.3
We may need to verify your identity before responding. Exercising your rights is free of charge unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, as permitted by law.
12. Cookies and Similar Technologies
12.1
Our website uses cookies and similar technologies that are strictly necessary to operate the site, and (with your consent) analytics cookies that help us understand usage. You can manage your preferences through your browser settings.
13. Changes to This Notice
13.1
We may update this Notice from time to time. The “Last updated” date at the top reflects the latest revision. Where changes are material, we will take reasonable steps to bring them to your attention.
14. Contact and Complaints
14.1
Questions, requests and complaints about this Notice should be sent to team@ancep.com.
14.2
If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority. In the United Kingdom, this is the Information Commissioner’s Office (ico.org.uk). If you are in the European Economic Area, you may contact the supervisory authority of the member state where you live or work.