Introduction
This notice describes how InsTech, as a data controller, collects, uses, shares and retains the personal data you provide and informs you of the choices regarding use, access and correction of your personal data. InsTech is committed to ensuring that any personal data it receives is protected and handled in accordance with applicable data protection laws. We also highlight our legitimate business interest in this policy.
For the purposes of this Privacy Notice, references to “InsTech” shall refer to InsTech London Limited (company number 10401598), and references to “we”, “us” or “our” shall refer to InsTech.
This Privacy Policy was last updated on the 26th of August 2026.
What personal data do we process about you, and why?
When you engage with InsTech through our content, events, website registration, reports and insights and other resources hosted on our website, we may collect basic personal data including name, email, job title and employer. We also collect this personal information about registered InsTech users during our website registration process. We refer to this privacy policy at all key InsTech content touchpoints.
Some of this information is also collected when subscribing to one of our InsTech newsletters. When you visit our website, your device and browser will automatically disclose certain information, some of which may constitute basic personal data. We also collect some publicly available information including IP Address, sector of the industry, current employer, workplace city of employment & seniority level. You can find more information about what we do with your data under our legitimate interest section below.
Individual Member Sign-up
When you sign up for individual membership, we collect the following personal data: name, email address, job title and company name, to provide specific benefits associated with InsTech’s individual membership.
Corporate Member Sign-up
When an individual who works for a corporate member takes advantage of InsTech’s corporate membership, we collect the following personal data: name, email address, job title and company name, to provide specific benefits associated with InsTech corporate membership.
Digital and Live Events
If you sign up to attend any of our events, we collect the following personal data: name, email address, job title, company name and IP address where applicable.
If you choose to give us dietary, accessibility or similar event requirements, we use that information only to make the requested arrangements. Where it reveals health, religious or other special-category information, we rely on your explicit consent. You do not have to provide it, and we normally delete it within 30 days after the event unless we need to keep it longer to deal with a specific issue.
Report downloads
When you download any InsTech reports, we collect the following personal data: name, email address, job title and company name.
Newsletters
When you sign up to receive our newsletter, we collect the following personal data: name, email address, job title, company name and, where applicable, IP address. We use this information to send the newsletter and related InsTech updates. For relevant business-to-business communications sent to corporate work addresses, we generally rely on our legitimate interests in developing and informing the InsTech community. Where the electronic marketing rules require consent—for example, for most personal email addresses, sole traders and certain partnerships—we will obtain consent or rely on the limited existing-customer exception where it lawfully applies.
If you do not want to receive further newsletters from InsTech, you can unsubscribe from each specific newsletter at any time using a link at the bottom of the newsletter email. Unsubscribing from a newsletter means you will not receive that newsletter; we may continue to contact you about other InsTech events and promotional opportunities. If you wish a full opt-out of any communications from InsTech, please email [email protected]
Website
We collect and send cookies. Cookies are small pieces of data that websites send to a user’s computer and are stored on the user’s web browser. They are designed to enable the website to remember information, such as what a user might have put in a shopping cart.
We use necessary cookies to operate the website and may use functional, analytics and advertising cookies as described below. We ask for consent before setting or reading cookies that are not strictly necessary, except where a specific legal exception applies, and you can change or withdraw your choices through our cookie controls. Analytics results may be aggregated, but this does not by itself remove the need for consent where the cookie rules require it.
We use the limited contact information collected for membership, events and report downloads to provide the content or service requested. Where we have a contract with you, we rely on that contract; where the contract is with your organisation or no contract is needed, we rely on our legitimate interests in administering the request and operating the InsTech community. We may also process personal data where necessary to comply with a legal obligation.
Our data principles and legitimate interest for sharing data
We care about the sustainable development of the insurance, insurtech and risk management sector. We have spent years growing a vibrant community built on the principles of trust, fair information exchange and providing value and insight to our clients.
As a community, we seek to create value by helping our members identify and build relevant business relationships. We may facilitate introductions or share limited professional contact information only where this is transparent, proportionate and consistent with the safeguards below.
Individuals in our sector engage with our content, events, reports and views through several mechanisms from clicking newsletter links to downloading reports and attending events. As outlined in our privacy policy, we collect data at those touch points.
Many of our activities are supported by sponsors. If we propose to share an attendee’s name, organisation, job title or work contact details with a named or clearly described event sponsor for relevant business follow-up, we will explain this prominently at registration and provide an easy opportunity to opt out. We rely on legitimate interests only where the attendee would reasonably expect the sharing, its impact is limited and our assessment shows that those interests are not overridden by the attendee’s rights.
Where we believe anonymity is important, for example, where individuals have engaged with our information on 3rd party services with no reference to our privacy policy, and where they are not an actively engaged member of InsTech or individual connected with a member business and have only nominally engaged with content on a 3rd party platform, we anonymise data that is shared.
We rely on legitimate interests for limited, relevant business networking and marketing where the purpose, necessity and balancing tests are met. We keep the relevant assessment proportionate to the limited professional contact data involved and respect any applicable right to object or opt out.
We may also use the marketing bases described in the Newsletters section to send relevant market updates, promotional materials and event invitations. You can opt out at any time. Any limited sharing with third parties is described in the section ‘Who are we sharing your data with?’.
Who are we sharing your data with?
To help manage our business and deliver services, we may share your personal data with third-party service providers such as IT suppliers, document management providers and others. We require all our third-party providers to respect the confidentiality and security of personal data. We may be under legal or regulatory obligations to share your personal data with courts, regulators and law enforcement bodies.
We may share limited professional information (such as name, organisation, job title and work email address) with an event sponsor or other business contact only in the circumstances described above. We do not sell personal data.
We may disclose aggregated or anonymised information that does not identify you individually, for example to report event participation or website trends. Any targeted advertising that relies on cookies or similar technologies is subject to the cookie choices described below.
Why do we share data outside of the UK?
We may transfer personal data to a country outside of the UK, for example if a third party we share data with has servers located outside of the UK. If this is the case, we will obtain your consent or otherwise ensure that the transfer is legal, and your data is secure by following UK guidelines. We may also make other disclosures of your personal data overseas, such as receiving a legal or regulatory request from a foreign law enforcement body.
We will always take steps to ensure that any international transfer of information is carefully managed to protect your rights and interests:
- We will only transfer your personal data to countries recognised as providing an adequate level of legal protection or where we can be satisfied those alternative arrangements are in place to protect your privacy rights.
- Transfers to service providers and other third parties will always be protected by contractual commitments and further assurances, where appropriate.
- Any requests for information we receive from law enforcement or regulators will be carefully checked before personal data is disclosed.
- We have listed below the systems we use, and where we send data outside of the UK and on what basis we do so.
- Airtable – Data is transferred outside of the UK to the United States.
- BrightTalk – Data is transferred outside of the UK to the United States.
- Google Analytics – Data is transferred outside of the UK to the United States.
- Google Forms – Data is transferred outside of the UK to the United States.
- Google Tag Manager – Data is transferred outside of the UK to the United States.
- HubSpot – Data is not transferred outside of the European Economic Area.
- Podbean – Data is transferred outside of the UK to the United States.
- Swoogo – Data is transferred outside of the UK to the United States.
How long do we keep your data?
We will retain your personal data for as long as is reasonably necessary to fulfil the relevant purposes set out in this Privacy Notice. The retention period will primarily be determined by applicable legal and regulatory obligations and/or the duration of our business relationship with you or another associated party. We check our data retention policy regularly to ensure we maintain a legitimate reason for retaining your data. We will securely delete or erase your personal data if there is no valid business reason for retaining your data. In exceptional circumstances, we may retain your personal data for longer periods of time if we reasonably believe there is a prospect of litigation in the event of any complaints or there is another valid business reason the data will be needed in the future.
We may retain a minimal suppression record after you opt out so that we can honour your preference. Event dietary or accessibility information is normally deleted within 30 days after the event, as explained above.
How do we keep your personal data secure?
We keep your data secure in the following ways:
- by following internal policies of best practice and training for staff
- by keeping personal data within our systems where possible
- by transferring data using best practices
- In the unlikely event of a breach of our security, we will inform the relevant regulatory body within 72 hours of the breach being discovered. If your personal data were involved in the breach, we shall also inform you.
Changes to our Privacy Notice and control
We may change this Privacy Notice from time to time. When we do, we will revise the date on this policy, notifying users of only significant changes. You agree to be bound by the revised Privacy Notice by continuing to access or use our services after those changes become effective.
Your rights
You have certain rights as an individual, which you can exercise in relation to the personal data we hold about you. If you request to exercise any of your rights, we reserve the right to ask you for proof of your identity. We aim to acknowledge your request as soon as possible and address your query within one month from your request.
The right to access
You are entitled to a confirmation whether we are processing your data, a copy of your data, and information about purposes of processing, who we disclose it to, whether we transfer it abroad and how we protect it, how long we keep it for, what rights you have, where we got your data from and how you can make a complaint.
The right to rectification
If you believe the personal data we hold about you is inaccurate or incomplete, you can request for it to be rectified.
The right to erasure
You have the right to ask for the erasure of your data where a legal right to erasure applies. This right is subject to legal exceptions, including where we need the data to comply with a legal obligation or establish, exercise or defend legal claims.
The right to restriction of processing
You can ask us to restrict (i.e. keep but not use) your personal data, but only where:
- Its accuracy is contested, to allow us to verify its accuracy; or
- The processing is unlawful, but you do not want it erased; or
- It is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or
- You have exercised the right to object, and verification of overriding grounds is pending.
- We can continue to use your personal data following a request for restriction, where we have your consent; to establish, exercise or defend legal claims; or protect the rights of another natural or legal person.
The right to data portability
In certain circumstances, where processing is automated and based on your consent or a contract with you, you can ask us to provide personal data you supplied in a structured, commonly used and machine-readable format, or to transmit it to another controller where technically feasible.
The right to object
You have the right to object at any time to processing of your personal data where processing is necessary for the performance of a task carried out in the public interest or the exercise of an official authority vested in the controller. You may also object where the processing is necessary for the purposes of the legitimate interests, except where such interests are overridden by your interests or fundamental rights and freedoms, where you are a child. You have an absolute right to object at any time to the use of your personal data for direct marketing, and we will stop that use.
The right to withdraw consent
Where we rely on your consent, you may withdraw it at any time by using the relevant unsubscribe or preference control, or by contacting [email protected]. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Cookies
Necessary
Necessary cookies are required to enable the basic features of this site, such as providing secure log-in or adjusting your consent preferences. These cookies do not store any personally identifiable data.
| Cookie | Duration | Description |
|---|---|---|
| __cf_bm | 1 hour | This cookie, set by Cloudflare, is used to support Cloudflare Bot Management. |
| __hssrc | session | This cookie is set by HubSpot whenever it changes the session cookie. The __hssrc cookie set to 1 indicates that the user has restarted the browser, and if the cookie does not exist, it is assumed to be a new session. |
| __hssc | 1 hour | HubSpot sets this cookie to keep track of sessions and to determine if HubSpot should increment the session number and timestamps in the __hstc cookie. |
| wordpress_test_cookie | session | WordPress sets this cookie to determine whether cookies are enabled on the users’ browsers. |
| rc::a | Never Expires | This cookie is set by the Google reCAPTCHA service to identify bots to protect the website against malicious spam attacks. |
| rc::c | session | This cookie is set by the Google reCAPTCHA service to identify bots to protect the website against malicious spam attacks. |
| PHPSESSID | session | This cookie is native to PHP applications. The cookie stores and identifies a user’s unique session ID to manage user sessions on the website. The cookie is a session cookie and will be deleted when all the browser windows are closed. |
| _csrf | session | This cookie is essential for the security of the website and visitor. It ensures visitor browsing security by preventing cross-site request forgery. |
| wpEmojiSettingsSupports | session | WordPress sets this cookie when a user interacts with emojis on a WordPress site. It helps determine if the user’s browser can display emojis properly. |
| cookietest | session | The cookietest cookie is typically used to determine whether the user’s browser accepts cookies, essential for website functionality and user experience. |
| cookieyes-* | 1 year | CookieYes sets this cookie for consent solution management. |
Functional
Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features.
| Cookie | Duration | Description |
|---|---|---|
| lidc | 1 day | LinkedIn sets the lidc cookie to facilitate data center selection. |
| li_gc | 6 months | LinkedIn set this cookie for storing visitor’s consent regarding using cookies for non-essential purposes. |
| ytidb::LAST_RESULT_ENTRY_KEY | Never Expires | The cookie ytidb::LAST_RESULT_ENTRY_KEY is used by YouTube to store the last search result entry that was clicked by the user. This information is used to improve the user experience by providing more relevant search results in the future. |
Analytics
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc.
| Cookie | Duration | Description |
|---|---|---|
| _ga | 1 year 1 month 4 days | Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site’s analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors. |
| _ga_* | 1 year 1 month 4 days | Google Analytics sets this cookie to store and count page views. |
| ga_clientId | Never Expires | Google Analytics sets this cookie to register statistical data on users’ behaviour on the website. |
| __hstc | 6 months | HubSpot set this main cookie for tracking visitors. It contains the domain, initial timestamp (first visit), last timestamp (last visit), current timestamp (this visit), and session number (increments for each subsequent session). |
| hubspotutk | 6 months | HubSpot sets this cookie to keep track of the visitors to the website. This cookie is passed to HubSpot on form submission and used when deduplicating contacts. |
| _hjSessionUser_* | 1 year | Hotjar sets this cookie to ensure data from subsequent visits to the same site is attributed to the same user ID, which persists in the Hotjar User ID, which is unique to that site. |
| _hjSession_* | 1 hour | Hotjar sets this cookie to ensure data from subsequent visits to the same site is attributed to the same user ID, which persists in the Hotjar User ID, which is unique to that site. |
| _hjTLDTest | session | To determine the most generic cookie path that has to be used instead of the page hostname, Hotjar sets the _hjTLDTest cookie to store different URL substring alternatives until it fails. |
| _pk_id.* | 1 year 1 month | Matamo set this cookie to store a unique user ID. |
| _pk_ses.* | 1 hour | Matomo set this cookie to store a unique session ID for gathering information on how the users use the website. |
Advertisement
Advertisement cookies are used to provide visitors with customized advertisements based on the pages you visited previously and to analyse the effectiveness of the ad campaigns.
| Cookie | Duration | Description |
|---|---|---|
| YSC | session | YouTube sets this cookie to track the views of embedded videos on YouTube pages. |
| VISITOR_INFO1_LIVE | 6 months | YouTube sets this cookie to measure bandwidth, determining whether the user gets the new or old player interface. |
| PBSECURESUSID | session | Podbean sets this cookie as a session cookie to verify that the users are on secure sessions. It helps with implementing audio files on the website. |
| NID | 6 months | Google sets the cookie for advertising purposes; to limit the number of times the user sees an ad, to unwanted mute ads, and to measure the effectiveness of ads. |
| bcookie | 1 year | LinkedIn sets this cookie from LinkedIn share buttons and ad tags to recognize browser IDs. |
| test_cookie | 15 minutes | doubleclick.net sets this cookie to determine if the user’s browser supports cookies. |
| _gcl_au | 3 months | Google Tag Manager sets this cookie to experiment advertisement efficiency of websites using their services. |
Uncategorized
Other uncategorized cookies are those that are being analysed and have not been classified into a category yet.
| Cookie | Duration | Description |
|---|---|---|
| VISITOR_PRIVACY_METADATA | 6 months | Description is currently not available. |
| __Secure-ROLLOUT_TOKEN | 6 months | Description is currently not available. |
| AWSALBTG | 7 days | No description available. |
| AWSALBTGCORS | 7 days | No description available. |
| __Secure-YEC | past | Description is currently not available. |
| __Secure-YNID | 6 months | Description is currently not available. |
About us
If you have any questions relating to data protection that you believe we can answer, please contact us as indicated below.
InsTech London Limited is a company incorporated in England and Wales with company number 10401598. Our registered office is at 10 Lower Thames Street, London, EC3R 6AF.
Complaints
If you have a concern about our use of your personal data, please contact us first at [email protected] so that we can try to resolve it. We will acknowledge a data-protection complaint within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority. Current contact details and the complaint service are available at https://ico.org.uk/make-a-complaint/.
