Privacy Policy

Palmira Capital Limited is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store and protect your personal information in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

Palmira Capital Limited is authorised and regulated by the Financial Conduct Authority ("FCA") under Firm Reference Number (FRN) 838259.

For the purposes of data protection law, Palmira Capital Limited is the data controller of your personal information.

Palmira Capital Limited has appointed a Data Protection Lead responsible for overseeing privacy compliance and handling data protection enquiries.

If you have any questions about this Privacy Notice, our use of your personal information, or wish to exercise any of your data protection rights, please contact:

Stephen Hills, Data Protection Lead
Email: shills@palmira.co.uk

The Information We Collect
We currently collect and process the following categories of personal information:

Identity Data: Name, date of birth and other information used to verify your identity.
Contact Data: Email address, telephone number and postal address.
Enquiry and Claim Data: Information relating to your enquiry, potential claim, eligibility assessment and any information you provide through our website, forms, telephone calls, email correspondence or other communications with us.
Financial Data: Payment and transaction information where applicable. Any payment information is processed in accordance with applicable security standards.
Technical Data: Internet Protocol (IP) address, browser type and version, operating system, device information, approximate location data, website usage information and cookie-related data.
Communication Data: Records of correspondence and communications with us. Telephone calls may be recorded for quality assurance, training, compliance and monitoring purposes.
Profile Data: Information relating to your preferences, feedback, survey responses and interactions with our services.
Special Category Data: Health-related or other sensitive personal information where relevant to assessing a potential claim and where permitted by law.
Representative Data: Information relating to individuals authorised to act on your behalf, including legal representatives, attorneys or other authorised agents.
Advertising and Analytics Data: Where you consent to the use of cookies and similar technologies, information concerning your interactions with our website, including pages visited, content viewed and engagement with our services.

Special Category Personal Data
Where necessary to assess the suitability, eligibility, or validity of a potential claim, we may collect and process special category personal data, including information relating to your health or other sensitive personal circumstances.

We will only process such information where permitted by law and where one or more of the conditions under Article 9 UK GDPR apply, including:

Article 9(2)(f) – processing is necessary for the establishment, exercise or defence of legal claims;
Article 9(2)(a) – you have provided your explicit consent;
Any other lawful condition applicable to the circumstances.

Where we rely on explicit consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.

How We Collect Your Information
Most of the personal information we process is provided directly by you when you:

Complete an enquiry form;
Contact us by telephone, email or post;
Request information about our services;
Provide information relating to a potential claim.

We may also receive information from authorised third-party firms where permitted by law and where you have consented to such sharing.

How We Use Your Personal Information
We use your personal information for the following purposes:

To assess your eligibility for making a claim;
To respond to enquiries and provide our services;
To refer your enquiry to authorised third-party firms where appropriate;
To communicate with you regarding your enquiry;
To comply with our legal and regulatory obligations;
To prevent fraud and maintain the security of our services;
To improve our website and customer experience.

Palmira Capital Limited acts as an introducer and lead generator only. We do not provide legal advice or claims management services directly. Where appropriate, enquiries may be referred to authorised third-party firms who will assess eligibility and provide services.

Eligibility Verification and Identity Checks
Where necessary to assess your eligibility for services, claims or referral opportunities, we may carry out verification and validation checks using information provided by you and information obtained from trusted third-party data providers. These checks may include identity verification, fraud prevention and eligibility assessments. Such checks may involve the use of soft credit search technology that does not affect your credit score.

Lawful Bases for Processing
Under the UK GDPR, we rely on the following lawful bases when processing your personal information.

Where we rely on Legitimate Interests as our lawful basis, those interests may include:

Responding to enquiries and assessing potential claims;
Operating, developing and improving our services;
Managing referrals to authorised third-party firms;
Conducting identity verification and eligibility checks;
Preventing fraud, financial crime and misuse of our services;
Maintaining business records and customer support functions;
Ensuring network and information security;
Complying with regulatory expectations and industry standards.

Before processing personal information on this basis, we carefully balance our legitimate interests against your rights, freedoms and reasonable expectations.

Where we rely on consent, you have the right to withdraw that consent at any time by contacting us.

Information Received From Third Parties

In some circumstances, we may receive personal information from third parties, including:

Authorised lead-generation partners;
Marketing partners;
Comparison websites;
Claims management companies;
Solicitors and legal representatives;
Identity verification providers;
Individuals authorised to act on your behalf.

Where we receive your information indirectly, we will process it only where permitted by law and provide appropriate privacy information as required under applicable data protection legislation.

Sharing Your Information and Referrals

Palmira Capital Limited acts solely as an introducer and lead generator.
Where appropriate and where you have requested assistance, consented to a referral, or otherwise instructed us to do so, we may share your personal information with authorised law firms, solicitors or regulated claims management companies for the purpose of assessing and progressing your enquiry.

We may also share your personal information with:

Solicitors, legal advisers and professional advisers acting on your behalf;
IT service providers, hosting providers, customer relationship management providers and other service providers supporting our operations;
Regulators, law enforcement agencies, courts, government bodies and other authorities where required by law;
Professional advisers, auditors and insurers.
We will only share your information where a lawful basis exists and appropriate safeguards are in place.

Where your enquiry is referred to a third-party firm, that organisation will generally become an independent data controller and will be responsible for its own use of your personal information. The referral partner's own privacy notice will apply to its processing activities.

Where consent is relied upon for a referral, you may withdraw that consent at any time, although this may affect our ability to progress your enquiry.

Where permitted by law, Palmira Capital Limited may receive a referral fee or other commercial benefit for introducing you to an authorised third-party firm. Any referral fee paid to Palmira Capital Limited does not increase the fees charged to you by the referral partner and does not affect your legal rights or the quality of service you receive.

Credit Reference Agencies and Verification Services

Where necessary to verify information provided by you and assess eligibility for certain services, we may use trusted third-party verification providers.

In particular, we may instruct Checkboard Ltd or other similar verification providers to carry out identity, affordability, fraud-prevention or eligibility checks on our behalf. These checks may involve obtaining information from credit reference agencies, including Equifax, Experian, TransUnion and CRAIN.

Where a soft credit search is carried out:

It will not affect your credit score.
It will not impact your ability to obtain credit.
A record of the search may be visible on your credit file as a soft footprint.
The results may be shared with Palmira Capital Limited solely for eligibility assessment, identity verification, fraud prevention and compliance purposes.

Any processing carried out by Checkboard Ltd or another verification provider will be subject to their own privacy information and terms of use in addition to this Privacy Notice.

Additional information regarding how verification providers and credit reference agencies process personal information can be obtained directly from the relevant provider. Where available, links to their privacy notices will be provided on request or through our website.

Information obtained during verification checks may be used to:

Confirm identity;
Assess eligibility;
Detect fraud;
Comply with legal and regulatory obligations;
Protect our business and customers from financial crime.

How We Store Your Information
We take appropriate technical and organisational measures to protect personal information against accidental loss, unauthorised access, disclosure, alteration or destruction.

Retention Periods

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to comply with legal, regulatory and business requirements.
Typical retention periods include:

Where it is necessary to establish, exercise or defend legal claims, certain information may be retained for longer periods.

International Transfers

We primarily store and process personal information within the United Kingdom.
Where personal information is transferred outside the UK, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements, including the use of adequacy regulations, the UK International Data Transfer Agreement (IDTA), or other approved transfer mechanisms.

Some of our service providers may store or process personal information outside the United Kingdom. Where this occurs, we will ensure appropriate safeguards are implemented in accordance with UK GDPR requirements to ensure your personal information remains protected.

Further information about any international transfers may be obtained by contacting us.

Marketing Communications

Where you have expressly consented, we may contact you by email, SMS, telephone or other electronic means regarding services relevant to your enquiry.

We will not send direct marketing communications where consent is required unless such consent has been obtained.

Where you consent to receiving information about services offered by trusted third-party firms, we may share your contact details with those firms so they can contact you directly regarding relevant services.

You may withdraw your consent at any time by:

Clicking the unsubscribe link contained within our emails;
Replying STOP to SMS communications where available;
Contacting us using the details provided in this Privacy Notice.

Withdrawal of consent will not affect processing carried out before consent was withdrawn.

Cookies and Analytics Technologies

Our website uses cookies and similar technologies to improve functionality, analyse website traffic and enhance user experience.

Some cookies are strictly necessary for the operation of our website, while others require your consent.

Further information about the cookies we use, the purposes for which they are used, and how to manage your preferences can be found in our Cookie Policy, available on our website. Where required by law, we will obtain your consent before placing non-essential cookies on your device. You may withdraw or amend your preferences at any time through our cookie settings tool.

Analytics and Advertising Technologies

Where you provide consent, we may use analytics and advertising technologies, including tools such as the Meta Pixel and similar technologies, to understand how visitors interact with our website and to measure the effectiveness of our advertising campaigns.

These technologies may collect information including:

Pages visited;
Content viewed;
Website interactions;
Device and browser information;
Referring websites and advertising sources.

This information may be shared with advertising and analytics partners to assist with attribution analysis, audience measurement, campaign optimisation and service improvement. Such technologies will only be used where required consent has been obtained in accordance with applicable privacy and electronic communications legislation.

Data Protection Policy

Palmira Capital Limited is committed to ensuring compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 through a structured data protection framework.
We adhere to the following core data protection principles:

Lawfulness, fairness and transparency – personal data is processed lawfully and transparently.
Purpose limitation – data is collected for specified, explicit, and legitimate purposes only.
Data minimisation – only personal data necessary for the intended purpose is collected.
Accuracy – reasonable steps are taken to ensure personal data is accurate and kept up to date.
Storage limitation – personal data is retained only as long as necessary.
Integrity and confidentiality – data is protected against unauthorised or unlawful processing, accidental loss, destruction, or damage.
Accountability – we take responsibility for compliance and can demonstrate it.

Governance and Responsibilities

Palmira Capital Limited acts as the Data Controller.
Responsibility for data protection compliance sits with senior management.
Staff handling personal data are trained in data protection obligations and confidentiality.
We implement appropriate policies, procedures, and controls to safeguard personal data.

Data Protection Measures

We implement appropriate technical and organisational measures, including:

Secure IT systems, encryption and access controls;
Restricted access to personal data on a need-to-know basis;
Staff confidentiality agreements;
Regular monitoring and review of data handling practices;
Secure disposal of personal data when no longer required.

Children's Privacy
Our services are intended for individuals aged 18 years and over.
We do not knowingly collect personal information from children. If we become aware that personal information relating to a person under the age of 18 has been collected without appropriate authority, we will take reasonable steps to delete that information.

Your Data Protection Rights
Under data protection law, you have the following rights:

Right of Access: You have the right to request copies of your personal information.
Right to Rectification: You have the right to ask us to correct inaccurate or incomplete information.
Right to Erasure: You have the right to request the deletion of your personal information in certain circumstances.
Right to Restrict Processing: You have the right to request that we restrict the processing of your information in certain circumstances.
Right to Object: You have the right to object to the processing of your personal information in certain circumstances.
Right to Data Portability: You have the right to request that your information be transferred to another organisation or directly to you where applicable.
Right to Withdraw Consent: You have the right to withdraw your consent at any time where we rely on your consent as the lawful basis for processing your personal information. Withdrawal of consent will not affect the lawfulness of processing carried out before your consent was withdrawn.

You will not normally be charged for exercising your rights. We will respond to requests within one month.
To exercise any of your rights, please contact us using the details below.

Automated Decision Making
We do not currently make decisions about individuals based solely on automated processing that produce legal effects or similarly significant impacts.

Where automated assessment tools are introduced in the future, this Privacy Notice will be updated accordingly.

Data Security and Personal Data Breach Policy
Palmira Capital Limited takes data security seriously and has procedures in place to detect, report, and investigate personal data breaches in accordance with UK GDPR requirements.

What is a Personal Data Breach
A personal data breach is a security incident that results in:

Loss, destruction, or damage to personal data;
Unauthorised access to or disclosure of personal data;
Accidental or unlawful processing of personal data.

Preventative Measures
We take proactive steps to minimise the risk of breaches, including:

Secure systems and firewalls;
Encryption and secure data transmission;
Access controls and authentication processes;
Staff awareness and training;
Data minimisation and retention controls.

Breach Identification and Reporting
All staff and service providers are required to:

Immediately report any suspected or actual data breach;
Escalate incidents internally without delay.

We maintain an internal breach register documenting:

Nature of the breach;
Categories and volume of data affected;
Likely consequences;
Actions taken to mitigate risks.

Breach Assessment
Upon becoming aware of a breach, we will promptly assess:

The risk to individuals’ rights and freedoms;
The severity and sensitivity of the data involved;
Potential impact (e.g. identity theft, fraud, distress).

Notification Obligations
Where required under UK GDPR:

We will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of a reportable breach;
Where a breach is likely to result in a high risk to individuals, we will notify affected individuals without undue delay.

Containment and Mitigation

We will take immediate steps to:

Contain the breach;
Recover lost data where possible;
Prevent recurrence (e.g. system updates, process improvements).

Review and Improvement
All breaches are reviewed to:

Identify root causes;
Improve systems and controls;
Strengthen staff awareness and procedures.

Contact Us
If you have questions regarding this Privacy Notice or wish to exercise your rights, please contact:
Palmira Capital Limited
Email: shills@palmira.co.uk
Registered Office: Colony, 5 Piccadilly Place, Manchester, M1 3BR, UK.
Company Number: 11357812
Telephone: +44 1615092416

How to Make a Complaint
If you have concerns about how we use your personal information, please contact us in the first instance using the details above.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk