Privacy Notice

Draft — last updated 2026-09-21. This notice has not yet completed final legal review.

Locasure ("we", "us") helps businesses identify potentially relevant insurance exposures from information they provide. This notice explains, at a technical level, what information the application collects, how it is used, and how it is protected.

Needs legal review: This notice does not yet state a confirmed legal entity name, registered address, or controller/processor position — see the placeholders below.

Who we are

Legal entity: [Legal entity name — to be confirmed]
Registered address: [Registered address — to be confirmed]
Company number: [Company number — to be confirmed, if applicable]

Needs legal review: Final company/brand name has not been chosen. Controller vs. processor status for each part of the service (e.g. when reviewing a business's own customer data within uploaded documents) also needs confirmation.

Information we collect

  • Contact/enquiry details you submit (name, business name, work email, phone number).
  • Account credentials and session information, managed by our authentication provider.
  • Business profile and assessment questionnaire answers.
  • Business documents you or your organisation choose to upload (e.g. asset registers, schedules, statements of value), and metadata about them (filename, file type, size, upload date).
  • Records of how Locasure staff review and process your enquiry/assessment.
  • Technical and security logs needed to operate and protect the service.

How we use information

Information is used to operate the assessment service: to respond to enquiries, to grant and manage account access, to record and compute your business's exposure assessment, to let staff review documents you provide, and to maintain the security and integrity of the service.

Needs legal review: The specific lawful basis (or bases) under UK GDPR for each of these purposes — contract, legitimate interests, consent, or another basis — has not yet been finalised and must be confirmed with legal input before this notice is relied upon.

Your account

Signing in uses an authentication session (see the Cookies page for detail). Only you and authorised Locasure staff can access your account's assessment and documents; access is independently verified on every request.

Business assessment information

Your questionnaire answers and business profile are used to compute the exposure summary shown in "My Assessment". This information is only ever shown to you and to authorised Locasure staff.

Documents you provide

Documents you or your organisation upload are stored in a private file store that is never publicly accessible. Staff can review and, where relevant to your assessment, reference the information within them; a document you upload is not automatically analysed or imported into your assessment unless staff deliberately choose to do so.

AI-assisted processing

Some interpretation of business/structured evidence is assisted by a third-party AI model. Where this happens, the system is designed to send only the minimum information needed for that specific interpretation step (for example, column headers and non-identifying sample values from a structured schedule) — not whole original documents, and not your name, email address, or other direct identifiers. AI-assisted interpretations are reviewed by Locasure staff before they are treated as part of your assessment.

Service providers

We use third-party service providers to run the application, including a database and authentication provider, private file storage, and an AI model provider for the assisted-interpretation feature described above. We intend to use a hosting provider for deployment.

Needs legal review: A confirmed subprocessor list, their locations, and appropriate data-processing agreements/international-transfer safeguards still need to be finalised and documented here.

Security

Access to your data is restricted to your own authenticated session and to independently-authorised Locasure staff. Documents are stored in a private store with no public URLs. We are not able to state that the service is compliant with any specific certification or standard at this stage.

Retention

We have not yet finalised specific retention periods for each category of information.

Needs legal review: Retention periods for enquiries, account data, assessment answers, uploaded documents, and audit/evidence records need a business/legal decision — see the internal retention matrix produced alongside this notice for the technical mechanisms available once those periods are set.

Your rights

Depending on applicable law, you may have rights to access, correct, delete, restrict, or receive a copy of your information, and to object to certain processing. To make a request, contact us using the details below.

Needs legal review: Some information may need to be retained despite an erasure/objection request (for example, for audit, security, or evidential integrity reasons) — the exact scope of any such exception needs legal confirmation before we describe it definitively to users.

International processing

Needs legal review: Whether any of our service providers process or store information outside the UK, and what transfer safeguard applies if so, needs to be confirmed and documented here.

Contact

For any privacy question or to exercise a data-protection right, contact privacy@example-placeholder.invalid.

Needs legal review: This is a placeholder inbox — it must be replaced with a real, monitored address before this notice is relied on. Data-protection contact role/DPO status ([Data protection contact — to be confirmed]) and ICO registration number ([ICO registration number — to be confirmed]) also need confirming.

Changes to this notice

We may update this notice as the service develops. Material changes will be reflected here with an updated date.

See also our Cookies page.