Privacy Policy

Last updated: 22nd June 2026.

Car Finance Claims (“we”, “us”, “our”) is committed to protecting your personal information and respecting your privacy. This policy explains how we collect, use, store, share and protect your personal information when you use our services or visit our website www.carfinanceclaims.com in accordance with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).

1. Who we are

Car Finance Claims is a trading style of Hallbrook Partners Ltd, a claims management company authorised and regulated by the Financial Conduct Authority (FCA).

Our registered office is:
C/O Atkinson Evans, The Old Drill Hall, 10 Arnot Hill Road, Nottingham, NG5 6LJ.

If you have any questions about this Privacy Policy or how we use your personal data, you can contact us at:
Email: help@carfinanceclaims.com
Telephone: 0115 822 1850

2. What personal data we collect

We may collect and process the following categories of personal information:

Contact information: name, address, previous address, email address, phone number.
Identification information: date of birth, proof of identity, proof of address.
Financial information: includes information on your financial circumstances, the lenders or financial institutions used by you, the financial products you have taken out and the details and status of those financial products. Bank details where requirement for payment of redress.
Case information: information you provide to us about your claim and correspondence between you, us, your lender, or the Financial Ombudsman Service.
Technical information: when you visit our website, we may collect your IP address, geographical location, browser type, device type, and cookies (see Section 9).
Marketing and Communications Data: your preferences in receiving marketing from us and/or our third party partners and your communication preferences.

Special Category Data: We will only process special category data where you have provided this to us and given your explicit consent to store it or we have a legal/regulatory obligation to. This includes race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data.

This list may not include all the information we require when providing our service/s. The information we ask you for will relate to your specific enquiry and will only consist of the information we need to carry out our service. If you contact us other than via our website, we will keep a record of that correspondence and a copy of call recordings.

3. Methods of collection

Direct interactions: By you filling in forms on our website or social media or by corresponding with us by post, phone, email or otherwise.

Third parties or public sources: We may receive information about you from various reputable third-party lead/data providers, from our regulators, your lenders, DVLA or from publicly available data.

Credit Information Firms: We may verify your identity through third party credit information firms who will carry out a soft credit search. We will always obtain your consent to do this and it will not affect your credit score in any way.

We will always inform you where we have obtained your information from if requested by you.

4. How we use your personal data

We use your personal data to:

Provide our claims management services to you.
Assess your eligibility to bring a claim.
Communicate with you about your claim.
Comply with legal and regulatory obligations.
Improve our website and services.
Carry out internal business reporting and quality assurance.
send you information or marketing about our products and services
resolve complaints against us or the establishment, exercise or defence of legal claims
inform you about changes in our services and important service related notices, such as security and fraud issues

5. Our lawful basis for processing

We rely on the following lawful bases under the UK GDPR to process your data:

Contract – processing is necessary to perform our contract with you or to take steps prior to entering into a contract with you.
Legitimate interests – Processing is necessary for the purposes of your legitimate interests or our legitimate interests, where your fundamental rights and interests do not override those interests. In order to determine this we shall undertake a Legitimate Interests Assessment and balancing test. This is usually, to pursue our business interests, such as verifying your identity, preventing fraud, providing claims services efficiently or to send marketing material.
Legal obligations – where we are required to comply with law or regulation.
Consent – such as where you agree to receive marketing communications.

6. Who we share your personal information with

We may share your personal data with:

Our panel of law firms and solicitors who progress your claim, upon your consent.

Each such third party will act as a data controller in relation to the data that we supply to it; and upon contacting you, each such third party will supply to you a copy of its own privacy policy, which will govern that third party's use of your personal data.
Subcontractors, such as external printers, IT service providers, credit information firms, admin companies, call centres, compliance consultants and legal advisers who support our operations.

Any external processors, who process your data on our behalf, are subject to a data processing agreement to ensure the safety and protection of your data. None of our processors are allowed to use your data for any other purposes than instructed by us.
Regulators, ombudsman schemes, government bodies or courts where legally required.
Valid8 IP Ltd for the provision of a soft credit search to locate your car finance agreements and identity information which may include Equifax Ltd, Experian Ltd, TransUnion with no impact on your credit score. You can access Valid8 IP’s privacy policy here. If you’d like to understand how the credit reference agencies use and share personal data (including the legitimate interests they pursue) please read the Credit Reference Agency Information Notice (CRAIN) http://www.transunion.co.uk/crain; https://www.equifax.co.uk/crain/; https://www.experian.co.uk/legal/crain/.

We will never sell your personal data to third parties.

7. How long we keep your personal data

We will keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet any legal, regulatory, accounting or reporting requirements.

We have some legal and regulatory obligations to hold certain pieces of information for specific timeframes for example, we are required to keep a copy of telephone call recordings for a period of 12 months after our last contact with you.

Where we have provided a service to you, we will hold all information relevant to this for 6 years to enable us to defend any claims/complaints made about our service. Information relating to any complaints will be held for a further 3 years.

We also need to keep some of your information for our accounting and reporting requirements.

Your contact details will be held for the purposes of direct marketing for 6 years, this is to enable us to let you know about new products or services that may be of interest to you as detailed in the marketing section.

8. International transfers

We generally store your personal data within the UK or European Economic Area (EEA). Where we use service providers outside the UK/EEA, we will ensure appropriate safeguards are in place (such as UK-approved standard contractual clauses).

9. Marketing

You are provided with choices regarding marketing and we record your preferences in relation to this and how we communicate with you.

We may rely on consent when we use your personal information for direct marketing. This will be where you have specifically consented to us or a third party that you are happy to receive marketing contact from us.

We may also rely on legitimate interests for our direct marketing. Our legitimate interests are to inform individuals about products or services which may be of interest to them. Our legitimate interest may also be our commercial interests in operating our business, which includes acquiring new customers, providing additional services to existing or previous customers that are similar or aligned with previous products or services and, expanding our operations.

You may also receive marketing communications from us if you have previously enquired about or purchased similar services from us and, in each case, you have not opted-out of receiving that marketing. This is known as a 'soft opt-in'.

Such marketing communications may be in relation to claims management, financial advice and legal services which could be done by post, email or telephone.

To opt out of receiving future marketing under any lawful basis, or under soft opt in, in which we intend to rely on for direct marketing, please opt-out using the contact details provided in this privacy policy. If you require any further information about the lawful basis we have relied on to send direct marketing to you, please do not hesitate to contact us.

10. Your rights

You have the following rights under data protection law:

Right to access – request a copy of your personal data we hold.
Right to rectification – correct inaccurate or incomplete data.
Right to erasure – request deletion of your data in certain circumstances.
Right to restrict processing – limit how we process your data.
Right to data portability – receive your data in a portable format.
Right to object – object to processing based on legitimate interests or direct marketing.
Rights relating to automated decision making and profiling

You may request that we to provide you with any personal information we hold about you. Where you send us a request to access your data, this will usually be free of change and sent to you within one month (unless your request is complex). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity before we are able to process your request.

We may withhold personal information that you request to the extent permitted by law.

You may instruct us at any time not to process your personal information for marketing purposes.

We may use automated decision making in our claims process and/or profiling in order to send you targeted marketing. You have the right to access details of the information we used to create your profile and the right to object to profiling, including profiling for marketing purposes. We do not use automated decision making which would produce legal or significant effects on individuals.

If at any point you wish to raise a complaint regarding our data handling then you have the right to complain to the Information Commissioner's Office (ICO) the supervisory authority for data protection issues in the UK whose information is available at www.ico.org.uk. However, we would appreciate to opportunity to deal with any concerns directly with you in the first instance.

11. Cookies and website data

Our website uses cookies to enhance your browsing experience and to collect analytics. You can set your browser to refuse cookies or alert you when cookies are being sent.

12. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a new “last updated” date.

Back to claims page