Privacy Information

Last Updated: June 2026

Introduction

This Privacy Policy explains how Halfords Limited and Call Assist Limited collect, use, store, share and protect your personal data when you:

• Obtain breakdown cover in connection with a vehicle service booking
• Purchase or receive a breakdown assistance policy
• Use our websites or services
• Contact us
• Otherwise interact with us.

It also explains your rights under applicable data protection laws, including the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) and any legislation implemented in connection with the aforementioned legislation.

We are committed to protecting your privacy and handling your personal data fairly, lawfully and transparently.

Please read this Privacy Policy carefully.  If you provide us with personal data relating to another person (for example, an additional named person on your policy), you should ensure that they have been made aware of this Privacy Policy.

1. Who We Are?

For the purpose of this Privacy Policy:

Halfords Limited (“Halfords is registered at Icknield Street Drive, Washford West, Redditch, Worcestershire B98 0DE.

When you book and purchase servicing through Halfords, Halfords acts as an Independent Data Controller for the personal data processed in connection with those services.

Further information about how Halfords processes personal data, including your rights and how to contact them, can be found in the relevant Halfords Privacy Policy available at www.halfords.com/customer-services/policies-and-regulations/privacy-policy.

Call Assist Limited (“Call Assist, “we”, “us” or “our”) is registered at Axis Court, North Station Road, Colchester, Essex, CO1 1UX. Halfords has partnered with Call Assist, who provide and administer the breakdown assistance policy included with certain vehicle servicing packages or otherwise purchased via the halfordsbreakdowncover.com website.

Call Assist acts as an Independent Data Controller in relation to:

• Breakdown policy administration
• Customer support
• Claims Handling
• Roadside recovery services
• Insurance and regulatory obligations
• Related communications.

Halfords acts as an Appointed Representative (“AR”) of Call Assist for certain insurance distribution activities.

Collinson Insurance Services Limited (“Collinson”), a trading name of Astrenska Insurance Limited, acts as an independent Data Controller in relation to the underwriting, administration and operation of the breakdown assistance policy.

Collinson may process personal data where necessary to:

• Underwrite and administer the policy
• Assess eligibility and risk
• Prevent and detect fraud
• Comply with legal and regulatory obligations
• Maintain appropriate records.

In connection with these activities, personal data may be shared between Halfords, Call Assist, Collinson, insurers, underwriters, recovery operators, claims handlers and other authorised service providers where necessary to provide the policy and associated services.

Collinson independently determines the purpose and means of processing personal data relating to underwriting and insurance administration activities and is therefore responsible for its own compliance obligations under applicable data protection law.

Further information about how Collinson processes personal data, including your rights and how to contact them, can be found in the relevant Collinson Privacy Policy available at www.collinson.co.uk/privacy-policy.

2. Data Protection Officer (“DPO”) 

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, you can contact: 

Data Protection Team, Call Assist Limited, Axis Court, North Station Road, Colchester, Essex, CO1 1UX or email dpo@call-assist.co.uk.

3. Supporting Vulnerable Customers

We are committed to identifying and supporting customers who may be vulnerable or require additional assistance.

In order to provide appropriate support and deliver our services safely and effectively, we may collect and use information relating to a customer's health, disability, accessibility requirements, communication needs, welfare circumstances or other factors that may indicate vulnerability.

We will only collect and use this information where it is necessary and proportionate to:

• Provide breakdown assistance, recovery services and claims support;
• Adapt our communications and services to meet individual needs;
• Protect the safety and welfare of customers and those assisting them;
• Ensure fair and appropriate customer outcomes;
• Meet our legal and regulatory obligations, including obligations under FCA rules and guidance relating to vulnerable customers.

Access to this information is restricted to those who need it for the purposes described above and is subject to appropriate confidentiality and security measures.

We are committed to delivering fair outcomes for our customers. We only collect and use personal data that is necessary to provide breakdown assistance, administer policies, process claims, comply with legal and regulatory obligations, prevent fraud and improve our services. We aim to communicate clearly and transparently about how your information is used so that you can make informed decisions about the products and services we provide.

4. Personal Data We Collect

The personal data we collect depends on the services you use and how you interact with us.

We may collect and process the following categories of personal data:

Call Recordings and Audio Data

Where you contact us by telephone, we may record calls and retain audio recordings, transcripts and associated records of those interactions. These recordings may contain personal data, including information you provide during the call and, where relevant, information relating to your policy, claim, breakdown incident, health, accessibility requirements or vulnerability.

We use call recordings to:

• Provide and administer our services;
• Verify instructions and maintain accurate records;
• Monitor and improve service quality;
• Train and support our employees and service providers;
• Investigate complaints, disputes and claims;
• Prevent and detect fraud and financial crime;
• Meet legal and regulatory obligations; and
• Support the operation of AI-assisted transcription and summarisation tools.

5. What Are Our Legal Grounds For Using Your Personal Data?

We only process personal data where we have a lawful basis under UK GDPR:

Performance of a contract – required in order to provide relevant services as described in the table below.

Legitimate Interests – required where necessary for our legitimate business interests provided those interests do not override your rights and freedoms as listed in the table below.

Legal Obligation – required to meet legal and regulatory requirements as listed below.

Consent – where you have given us permission as required by law, including information listed in the table below.  You may withdraw your consent at any time.

*Footnote:
In limited circumstances, we may process special category personal data, including health information, disabilities, accessibility requirements and welfare information, where necessary to provide roadside assistance, administer claims, support vulnerable customers, protect an individual's vital interests, comply with legal and regulatory obligations, prevent and detect fraud, or establish, exercise or defend legal claims.

We may also process criminal offence data where necessary for fraud prevention, financial crime investigations, insurance claims handling, legal proceedings or compliance with regulatory requirements.

Such processing is undertaken in accordance with Articles 9 and 10 of the UK GDPR and Schedule 1 of the Data Protection Act 2018 and is subject to appropriate safeguards.

Our legitimate interests include:

• Administering and improving our breakdown assistance, recovery and related services.
• Providing efficient customer support and resolving customer queries, complaints and disputes.
• Monitoring, assessing and improving the quality, effectiveness and performance of our services.
• Training staff and monitoring service standards, including the review of customer interactions and call recordings.
• Preventing, detecting and investigating fraud, theft, financial crime, misuse of services and other unlawful activity.
• Protecting the safety and welfare of our customers, employees, contractors and service providers.
• Managing business operations, auditing, reporting and maintaining appropriate business records.
• Ensuring the security and integrity of our systems, networks, websites and services, including identifying and responding to cyber security threats.
• Developing, testing and improving products, services, systems and operational processes.
• Using artificial intelligence, machine learning and automated technologies to assist with service delivery, quality assurance, operational efficiency and customer support, subject to appropriate safeguards and human oversight where required.
• Establishing, exercising or defending legal claims and protecting our legal rights and interests.
• Meeting regulatory expectations and industry standards applicable to our business.

You have the right to object to processing carried out on the basis of legitimate interests. Further information about this right can be found in the "Your Rights" section of this Privacy Policy.

6. How Is Your Personal Data Collected?

We use a variety of methods to collect data from and about you including:

• Direct interactions. We collect your personal data when you order a product or service from us either via our contact centre or website. You may also give us your personal data when you correspond with us by post, phone or email.
• Automated technologies or interactions. When you use our website, we will collect your personal data via cookies, server logs and similar technologies, unless you choose otherwise by changing your browser settings. Please see our Cookies Policy https://www.halfordsbreakdowncover.com/info/cookies for further details.
• Third parties or publicly available sources. We source personal data from various third parties, such as insurers and underwriters, fraud prevention agencies, recovery operators, claims handlers, publicly available information from the DVSA, data available to the insurance industry and loss adjusters as well as data from analytics providers.

7. Use of Artificial Intelligence and Automated Decision-Making

We use artificial intelligence (AI), machine learning, and other automated technologies to help deliver, manage, and improve our services.

How we use these technologies:

• AI tools are used to transcribe and summarise call recordings.
• Automated systems help process claims submitted through our online reporting services. They make an initial assessment, but any claim flagged for rejection is reviewed by a member of staff before a final decision is made.
• Automated systems assist in allocating vehicle recovery operators. If a suitable allocation cannot be made automatically, a member of staff reviews the case to ensure the right operator is assigned.

Your rights and safeguards:

• We do not rely solely on fully automated decisions that could have legal or similarly significant effects on you, unless the law allows it and appropriate safeguards are in place.
• All automated processing is carried out under human supervision and in line with UK data protection law.

8. Sharing Your Information

We will only disclose/share information about you or your policy where necessary and lawful. 

We may share information with:

• Insurers and underwriters
• Roadside recovery operators and others involved in the execution of claims handling such as taxi, hotel and car hire etc
• Claims handlers
• Fraud prevention agencies
• Payment processors
• IT and hosting providers
• Customer communication providers
• Legal and professional advisers
• Regulators and law enforcement agencies
• Medical professionals where necessary.

Data Sharing Between Halfords and Call Assist

Where a breakdown policy is included as part of a vehicle service package, Halfords will securely share relevant customer and vehicle information with Call Assist so that:

• The breakdown policy can be issued
• Policy documentation can be provided
• Customer support can be delivered
• Regulatory obligations can be met.

Each organisation remains independently responsible for its own processing activities and compliance obligations under applicable data protection law.

Where Halfords provides customer information to Call Assist in connection with a breakdown policy, only information necessary to administer the policy and provide associated services will be shared.

All third parties are required to protect your personal data and only process it in accordance with applicable data protection laws.

9. Marketing Communications

Halfords and Call Assist will only send marketing communications where permitted by law.

Where required, we will obtain your consent before sending electronic marketing communications.

You can opt out of marketing at any time by:

• Clicking the unsubscribe link in emails
• Updating your communication preferences
• Contacting us directly.

No marketing relating to breakdown or insurance products will be carried out without appropriate regulatory oversight and approval by Call Assist.

We do not sell personal data to third parties for marketing purposes.

10. International Data Sharing

Some of our service providers may process personal data outside the United Kingdom.

This is most likely to occur if you break down outside the UK and make a claim. In these circumstances, we may share your personal data with our trusted business partners in Europe to enable them to provide assistance and manage your claim on our behalf.

Where personal data is transferred internationally, we ensure appropriate safeguards are in place to protect your data and ensure that the protection of your data is not materially lower to that provided under UK data protection law. These safeguards may include:

• Transfers to countries that have been deemed to provide an adequate level of protection by the UK Government (known as “adequacy regulations”)
• Ensuring that there are standard data protection clauses in the contract between us and the provider, including either the UK International Data Transfer Agreement (“IDTA”) or the UK Addendum to EU Standard Contractual Clauses
• Other legally approved safeguards as permitted under UK data protection law.

11. Cookies and Similar Technologies

We use cookies and similar technologies to:

• Operate and improve our websites
• Analyse website usage
• Personalise content
• Measure marketing effectiveness.

You can manage cookie preferences through our cookie settings or browser controls.

Further information is available in our Cookies Policy.

12. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, disclosure or destruction.

These measures include:

• Data encryption
• Secure access controls
• Multi-factor authentication
• Staff confidentiality obligations
• Secure back-ups
• Malware protection
• Role-based access permissions.

We may also use automated monitoring tools, including AI-assisted technologies, to help identify security threats, fraudulent activity, service misuse and operational issues in order to protect customers, systems and services.

Although we take appropriate security measures, no system can be guaranteed completely secure.

13. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for. This includes:

• Providing services
• Meeting legal and regulatory obligations
• Handling claims and disputes
• Fraud prevention
• Enforcing legal rights.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. 

By law, insurance and claims-related records are generally retained for seven years following the end of the policy or final resolution of a claim, unless a longer retention period is required by law or regulation.

In some circumstances you can ask us to delete your data. 

14. Your Rights

Under data protection legislation, you have a number of rights relating to the information we hold about you. This includes the right to:

• ask for a free copy of any personal data we hold about you
• ask for correction of any inaccurate information held about you
• object to the use of your personal data for marketing purposes or where we use your personal data for our legitimate interests
• withdraw any consent you have previously given to us to process your personal data;
• ask for your personal data to be deleted from our systems (NB there are times when we will not be able to delete your data as a result of us fulfilling our legal and regulatory obligations, or where there is a minimum statutory period of time for which we have to keep your information. If we are unable to fulfil a request, we will always let you know our reasons)
• not to be subject to automated decision making (without human involvement) where that decision produces a legal or other significant effect on you
• obtain, move, copy or transfer your personal information in a format which enables you to transfer that data to another organisation
• request that we suspend our processing of your personal data
• complain to the Information Commissioner’s Office if you are not satisfied with our use of your data (https://ico.org.uk).

Should you wish to exercise any of your rights, please direct your enquiry to the Data Protection Officer, Call Assist Limited, Axis Court, North Station Road, Colchester.CO1 1UX or email dpo@call-assist.co.uk.

15. Raising a Data Protection Complaint With Us 

In addition to your right to complain to the Information Commissioner's Office, if you have an issue about how we handle your personal data under the UK GDPR, you can raise a complaint with us directly.

You can raise a complaint with us by:

• Outlining the nature of your complaint in an email to DPO@call-assist.co.uk;  or
• Making a complaint via our contact form. Please note that you can select the dropdown box to choose "Data Protection Query/Complaint" and outlining the nature of your complaint in the message textbox.

We will acknowledge your complaint within 5 working days of receiving it and provide a substantive response and outcome of the complaint within 8 weeks of receiving the complaint. We will endeavour to send an update on the progress of your complaint within 4 weeks of receiving the request.

16. Links to Other Websites

Our websites may contain links to third-party websites or services.

We are not responsible for the privacy practices or content of third-party websites.

You should review their privacy policies separately.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes in law or regulation
• updates to our services
• operational changes
• technological developments.

The latest version will always be available on our website.