Privacy Policy

Last updated: 24 July 2026

1. Introduction

Keystone Accident Management Ltd (“Keystone”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and share personal information when you:

• Visit www.keystone-assist.co.uk;
• Contact us by telephone, email, online form, live chat or WhatsApp;
• Request a Callback;
• Start or enquire about a non-fault accident claim;
• Ask us to arrange accident recovery, vehicle storage, repairs or a replacement vehicle;
• Provide information relating to an injury, financial loss or other accident-related matter; or
• Otherwise communicate or engage with us.

This notice is intended to meet the transparency requirements of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. The ICO explains that organisations must tell individuals why their information is used, how long it is retained and with whom it may be shared. ICO guidance on the right to be informed.

2. Who we are

The controller responsible for the personal information described in this policy is:

Keystone Accident Management Ltd
Unit 4, 53 Towers Road
Grays, Essex
RM17 6ST
United Kingdom

Telephone: 020 3967 1999
Email: info@keystone-assist.co.uk
Website: www.keystone-assist.co.uk
Company number: 17327148
ICO registration number: [INSERT OR CONFIRM ICO NUMBER]

Keystone may introduce customers to appropriately authorised or regulated third-party providers. Depending on the circumstances, those providers may process your information as separate data controllers and provide you with their own privacy information.

3. Information we collect

3.1 Information you provide directly

We may collect:

• Your full name;
• Home or correspondence address;
• Email address;
• Telephone number;
• Preferred contact method and contact times;
• Vehicle registration number;
• Vehicle make, model, condition and location;
• Driving licence and insurance information;
• Taxi, private-hire or PCO licence information;
• Accident date, time, location and circumstances;
• Details of drivers, passengers, witnesses and other parties;
• Photographs, videos, dashcam footage and accident documents;
• Police reference numbers and incident reports;
• Insurer, policy and claim-reference information;
• Details about vehicle damage, recovery, storage and repairs;
• Replacement-vehicle requirements;
• Information about financial losses, loss of earnings or other expenses;
• Your occupation and employment information, where relevant;
• Bank or payment information, where legitimately required;
• Copies of correspondence with insurers, solicitors or other organisations;
• Call recordings, emails, chat messages and notes of conversations;
• Marketing preferences and consent records; and
• Any other information you choose to provide.

The website’s current enquiry form asks for your name, telephone number, email address, vehicle registration, accident date, whether the vehicle is driveable, whether anyone was injured and a description of the accident.

3.2 Health and injury information

If you tell us that you or another person was injured, we may receive information about:

• The type and severity of an injury;
• Symptoms, treatment and recovery;
• Medical appointments and reports;
• Disability or accessibility requirements; and
• The effect of an injury on work, earnings or daily life.

Health information is “special category data” and receives additional legal protection. Processing it requires both an Article 6 lawful basis and an Article 9 condition. ICO guidance on special-category data.

Where applicable, we process health information with your explicit consent and/or where necessary for the establishment, exercise or defence of legal claims. We will not request more health information than is reasonably necessary.

Please avoid sending detailed medical records through ordinary website chat or WhatsApp unless we specifically request them and provide an appropriate method.

3.3 Information collected automatically

When you visit our website, our systems and hosting providers may collect:

• IP address;
• Browser and device type;
• Operating system;
• Referring website;
• Pages viewed;
• Date and time of access;
• Error, security and server-log information; and
• Cookie consent choices.

We use this information to deliver the website, maintain security, diagnose technical problems and understand general website performance.

3.4 Information obtained from other sources

Where necessary for an enquiry or claim, information may be obtained from:

• Other drivers, passengers or witnesses;
• Family members or authorised representatives;
• Insurers and insurance intermediaries;
• Solicitors and claims professionals;
• Accident-management and credit-hire providers;
• Police or other public authorities;
• Vehicle recovery and storage operators;
• Repairers, engineers and vehicle assessors;
• Medical professionals and rehabilitation providers;
• Employers or accountants, particularly for loss-of-earnings evidence;
• Fraud-prevention organisations; and
• Publicly available sources.

If you provide information about another person, you should have a lawful reason to do so and, where appropriate, make them aware of this Privacy Policy.

4. How we use your information

We may use personal information to:

• Respond to enquiries and callback requests;
• Conduct an initial accident or eligibility assessment;
• Confirm your identity and contact details;
• Understand the accident and the assistance required;
• Introduce you to an appropriate regulated or specialist partner;
• Arrange or coordinate vehicle recovery and storage;
• Arrange vehicle inspections and repairs;
• Assist with replacement-vehicle requirements;
• Communicate with insurers, solicitors, repairers and service providers;
• Help document accident-related losses;
• Maintain records of enquiries, introductions and services;
• Provide updates and customer support;
• Handle complaints and data-protection requests;
• Prevent fraud, misuse and unlawful activity;
• Protect our systems, staff, customers and business;
• Establish, exercise or defend legal claims;
• Meet legal, regulatory, tax, accounting and insurance obligations;
• Monitor and improve our services;
• Train and supervise staff; and
• Send marketing communications where legally permitted.

Submitting an enquiry does not guarantee that a claim will be accepted or that any particular service will be provided.

5. Our lawful bases

Depending on the circumstances, we rely on one or more of the following lawful bases:

Consent

We may rely on consent when:

• You ask us to contact you about your enquiry;
• You agree to receive marketing;
• We need explicit consent to process particular health information; or
• Consent is required for non-essential cookies.

You may withdraw consent at any time. Withdrawal does not make earlier processing unlawful.

Contract and steps before entering a contract

We process information where necessary to respond to a service request, assess your requirements or provide services you have requested.

Legitimate interests

We may process information where necessary for legitimate business purposes, including:

• Responding to enquiries;
• Coordinating services;
• Maintaining business and claim records;
• Preventing fraud;
• Protecting our systems;
• Improving customer service; and
• Establishing or defending legal rights.

We consider the likely impact on your rights before relying on this basis.

Legal obligation

We may process information to comply with applicable laws, court orders, regulatory requirements, accounting rules or obligations to law-enforcement authorities.

Legal claims and special-category information

Where injury or health information is relevant, we may process it with explicit consent or where necessary for the establishment, exercise or defence of legal claims.

6. Sharing your information

We may share information, where necessary and proportionate, with:

• FCA-authorised or otherwise regulated partners;
• Solicitors and legal-service providers;
• Your insurer and the insurer of another party;
• Accident-management and credit-hire providers;
• Vehicle recovery and storage operators;
• Approved repairers and body shops;
• Vehicle engineers, assessors and inspection services;
• Replacement-vehicle suppliers;
• Medical experts, healthcare providers and rehabilitation services;
• Loss adjusters and claims investigators;
• Police, courts, regulators and public authorities;
• Fraud-prevention and identity-verification providers;
• Our hosting, website, email, telephone, live-chat and IT suppliers;
• Professional advisers, auditors and insurers;
• Prospective buyers or investors if our business is reorganised or sold; and
• Other parties where you direct or authorise us to share information.

We do not sell personal information as a commodity.

A receiving partner may become an independent controller when it determines how and why your information will be used. You should review that organisation’s privacy notice before entering into an agreement with it.

7. Calls, email, live chat and WhatsApp

Telephone calls

Calls may be recorded or monitored for training, quality assurance, complaint handling, fraud prevention and evidential purposes. If call recording is active, callers should be informed at the beginning of the call.

Email

Ordinary email is not always completely secure. Please do not email sensitive medical, identity or financial documents unless requested and an appropriate transfer method has been agreed.

Live chat

Messages sent through the website’s live-chat facility may be stored with your contact details, IP address, timestamps and conversation history so that we can respond and maintain appropriate business records.

Do not include unnecessary medical, banking or identification information in live-chat messages.

WhatsApp

If you choose to contact us through WhatsApp, Meta/WhatsApp will process certain information under its own terms and privacy policy. Your use of WhatsApp is voluntary, and you may contact us by telephone or email instead.

8. Marketing communications

We may contact you about the specific enquiry you submitted. Service-related contact is not necessarily marketing.

We will only send unrelated promotional emails, text messages or similar electronic marketing where we have an appropriate lawful basis and comply with the Privacy and Electronic Communications Regulations 2003 (“PECR”).

You can opt out at any time by:

• Using an unsubscribe option in the communication;
• Emailing info@keystone-assist.co.uk;
• Calling 020 3967 1999; or
• Asking the person who contacts you to stop.

You have an absolute right to object to the use of personal information for direct marketing. ICO guidance on the right to object.

We may keep limited information on a suppression list to ensure that your opt-out preference continues to be respected.

9. Cookies and similar technologies

Our website uses cookies and similar technologies for website operation, security, preference management and, where enabled, analytics or marketing.

A consent cookie named cc_cookie_consent_v1 may be stored for up to 180 days to remember your cookie choice.

Strictly necessary cookies may be used without consent where permitted by law. Non-essential analytics, advertising or tracking technologies must not be activated until valid consent has been obtained.

The website also loads resources including Google-hosted fonts. This may cause technical information, such as an IP address and browser details, to be transmitted to Google when a page loads.

Further information should be provided in a separate Cookie Policy. PECR applies to cookies and similar technologies, and valid consent must be freely given, specific, informed and demonstrated through a positive action. ICO cookie guidance.

You can also control cookies through your browser settings, although blocking necessary cookies may affect website functionality.

10. International transfers

We aim to keep personal information within the United Kingdom or European Economic Area wherever reasonably possible.

Some technology suppliers—including email, hosting, cloud, Google, Meta/WhatsApp or support-service providers—may process information in other countries.

Where information is transferred outside the UK, we will use a lawful transfer mechanism where required, such as:

• UK adequacy regulations;
• The UK International Data Transfer Agreement;
• The UK Addendum to approved contractual clauses; or
• Another safeguard permitted by data-protection law.

You may contact us for more information about the safeguards applying to a particular transfer.

11. Data retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, regulatory, insurance, accounting and evidential requirements.

Retention periods may include:

• Unsuccessful or general enquiries: normally up to 24 months after the last meaningful contact;
• Callback and contact-form records: normally up to 24 months;
• Live-chat records: normally up to 24 months;
• Claim, introduction and service records: normally six years after the matter is closed, or longer where required by law or an ongoing dispute;
• Complaint records: normally six years after resolution;
• Financial and accounting records: normally six years;
• Call recordings: for a limited period appropriate to quality, complaint and evidential needs;
• Cookie preferences: according to the duration stated in the Cookie Policy; and
• Marketing suppression records: for as long as necessary to respect the opt-out request.

Specific information may be retained longer where a claim, complaint, investigation or legal obligation remains active. Information that is no longer required will be securely deleted, anonymised or otherwise placed beyond use.

12. Data security

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, misuse, alteration or disclosure.

These measures may include:

• HTTPS encryption;
• Access controls and user permissions;
• Authentication and password controls;
• Secure hosting and backups;
• Software and security updates;
• Malware and spam protection;
• Staff confidentiality requirements;
• Supplier due diligence; and
• Incident-response procedures.

No internet transmission or storage system can be guaranteed completely secure. If a personal-data breach creates a risk to individuals, we will assess whether notification to the ICO or affected individuals is legally required.

13. Your data-protection rights

Depending on the circumstances, you may have the right to:

• Be informed about how your information is used;
• Request access to your personal information;
• Have inaccurate information corrected;
• Have incomplete information completed;
• Request deletion of information;
• Request restriction of processing;
• Object to processing based on legitimate interests;
• Object to direct marketing at any time;
• Receive certain information in a portable format;
• Withdraw consent;
• Challenge certain solely automated decisions; and
• Complain to the Information Commissioner’s Office.

These rights are not absolute and may be subject to legal exceptions. The ICO provides an overview of these rights in its guide to individual rights.

To exercise a right, contact:

Email: info@keystone-assist.co.uk
Post: Unit 4, 53 Towers Road, Grays, Essex, RM17 6ST

We may request evidence of identity before disclosing or changing personal information. We normally respond within one month, although the law permits an extension in certain complex cases.

14. Automated decision-making

We do not currently make decisions producing legal or similarly significant effects solely through automated processing.

Initial enquiry questions may be used to route your enquiry or identify potentially suitable services, but a person or specialist partner should review eligibility before a final decision is made.

If this changes, we will update this Privacy Policy and provide the information required by law.

15. Children

Our accident-management services are primarily intended for adults.

Information about a child may sometimes be relevant when the child was a passenger or was otherwise involved in an accident. Such information should normally be provided by a parent, guardian or properly authorised representative.

We do not knowingly use children’s information for marketing.

16. Links and third-party websites

Our website may contain links to third-party websites and services. We are not responsible for how independent third parties collect or use personal information.

You should review the relevant third party’s privacy policy before providing information to it.

17. Complaints

Please contact us first if you have a concern about how we have handled your personal information:

Email: info@keystone-assist.co.uk
Telephone: 020 3967 1999
Post: Unit 4, 53 Towers Road, Grays, Essex, RM17 6ST

You also have the right to complain to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk

18. Changes to this policy

We may update this Privacy Policy when our services, suppliers, legal obligations or information-handling practices change.

The latest version will be published on this page with an updated revision date. Material changes may also be communicated through the website or directly to affected individuals where appropriate.