Our privacy policy.
How we look after your personal information — what we collect, why, and the rights you have over it.
We’re committed to safeguarding and preserving the privacy of personal data. This privacy notice explains what happens to any personal data you provide to us, or that we collect from you. In this privacy notice, references to “our”, “us” and “we” are to Vara.
Koral AI Operating Company Limited is registered in England and Wales under company number 17256222. We are an appointed representative of Innovative Risk Labs Ltd, which is authorised and regulated by the Financial Conduct Authority under firm reference number 609155. Our registered office address is 101/6 Pearson Square, London, England, W1T 3BJ.
We are registered with the Information Commissioner’s Office (ICO) as a data controller.
If you have any questions about our privacy notice, please email privacy@vara.insure.
This privacy notice describes how and why we obtain, store, and process information that can identify you directly or indirectly, such as your name, contact details, business information, and location information. This privacy notice applies where we’re acting as a data controller in respect of your personal data. References to the processing of information include the collection, use, storage, and protection of personal data. All personal data collected by us will only be processed in accordance with this privacy notice.
Privacy notice last updated: August 2026.
Security
How we protect information.
We’re committed to ensuring that the information we process is as secure as possible. In order to prevent unauthorised access, use or disclosure, we’ve put in place physical, electronic and organisational procedures to protect it. Anyone processing personal data in our team or on our behalf must do so in accordance with this privacy notice, and on the basis that we’re satisfied that they can and will adhere to our high standards for data protection and security.
Information entered on our website and email data processed by our mail servers is encrypted in transit using HTTPS over Transport Layer Security (TLS). We use encryption as well as Secure Sockets Layer certificates (SSL) when sending payment information to our payment providers. Please note, however, that transmission of data over the internet is inherently insecure, so we can’t guarantee the security of information sent over the internet.
What we collect
Information we collect, and how we use it.
Generally, information we may collect from and process about you falls into the following categories:
1
Information we collect from you through our product application or renewal process, or through the management of your account — for example, your name, contact details and information about your business, or claims history. Financial information relating to your payments to and from us. This could be on the website, on the phone, or if you write to us; generally we refer to this as “Account Data”.
2
Information automatically collected about you when you visit our site (“Website Data”) — Website Data may include your IP address, browser type and version, location data, source of referral, length of visit, pages you view, search queries you make and general use of our website.
3
Information from third party sources — for example, sanctions checks, information from third party insurers and underwriters, information about your use of services from analytics software, information about your business online.
4
Information provided by you through social media, like queries and complaints to us.
Where else we get data
Information from other sources.
We may use legally available public sources, such as the electoral roll, and other third-party sources such as credit reference agencies, to obtain information about you — for example, to verify your identity or check your credit history.
Some personal information may be provided to us by third parties such as insurance companies and other insurance intermediaries. In some cases you will have previously submitted your personal information to them and given them approval to pass this information on for certain purposes.
Such information will only be obtained from reputable sources which operate in accordance with data protection law.
We and other parties may use your information for purposes such as statistical and trend research and analysis, which may include computerised processes that profile you. Automatic profiling helps us understand and forecast customer preferences, improve the products and services we make available, and prepare your risk so that the broker advising you can assess which policies on our panel are worth recommending. The recommendation is made by a person, not by a system, and the decision to buy is yours.
Your visit to this site
Information collected during your visit.
Whenever you browse our website, read pages or download information, computers automatically record certain information about your visit. This information does not identify you personally. It tells us how many visitors come to our site, which pages they looked at, and the types of computers and browsers they use. With this information we can improve our site for all our visitors.
The information includes the following:
1
The date and time you access our site.
2
How many and which pages you visit during a session on our site, and how long you were on the site.
3
Your internet domain name (this might be your internet service provider, or your place of work) and the IP address assigned to your computer, which allows you to access our website.
4
The internet browser you use (for example Microsoft Edge, Google Chrome or Safari), your computer’s operating system, and the site you were on before you linked to our website (for example a search engine).
Our purposes
Why do we use your information?
Your Account Data will be processed for a number of reasons, including:
1
To assess your insurance requirements
2
To provide cover
3
To calculate your insurance premiums and policy conditions
4
To obtain and provide you with quotes for insurance
5
To arrange and manage your insurance policies, including claims, mid-term alterations, renewals and cancellations
6
To follow up with you by email when you have started the application process
7
To provide our products and services
8
To comply with our legal and regulatory obligations
We may also use this information to help us improve and sell our services, and to monitor our compliance with regulatory requirements.
We use technology to help build a profile of your risk and to approach the insurers on our panel efficiently on your behalf. This includes automated processing to prepare and structure that risk profile. The advice itself is not automated: a named person at Vara reviews the insurers’ responses, decides what to recommend to you, and is responsible for that recommendation. You will always be able to speak to that person about it, and the decision to buy is yours.
Our lawful basis
The lawful basis for using your personal information.
The law sets out the permitted basis for our processing of your information. We rely on the following bases to process your data:
1
Legitimate interests — the processing is necessary for our, your or a third party’s legitimate interests, unless overridden by your personal data rights.
2
Contract — the processing is necessary for an insurance policy between us, or because we are taking specific steps towards entering into a contract with or on behalf of you.
3
Legal obligation — we process personal data where necessary to comply with any legal obligations we’re subject to; to establish or defend any legal claims so as to protect our or your legal rights, or the legal rights of other interested parties; or to obtain or maintain our own insurance cover, obtain professional advice or otherwise manage business risks.
4
Vital interests — the processing is necessary in order to protect the vital interests of the data subject or of another natural person. For example, where there is a risk of someone harming themselves or others, this basis will override consent.
5
Consent — for certain activities, where we need your express consent to process your information, we will obtain it prior to using your information, and you can change your mind at any time.
6
Public interest — for instance, cooperating voluntarily with a police investigation.
We will confirm in writing the lawful basis on which we are processing your data at the time we process it.
Phone calls
Call recording.
Please note that we record phone calls for the following purposes:
1
Collecting Account Data
2
Training and monitoring our team
3
Fraud prevention and security
4
Quality assurance and service improvement
5
Compliance with regulatory requirements
We don’t store payment card information on our systems. Please don’t send it to us. We will never ask you for your bank details.
Sharing your data
Information we share with third parties.
We share Account Data with:
1
The insurers and managing general agents on our panel, so that we can obtain quotes and arrange and manage your cover. These firms are named individually on our insurer list, and each of them decides for itself how it uses your information.
2
Other businesses in the insurance industry, such as other intermediaries acting for you or for an insurer
3
Business service providers and external consultants, for the purposes of calculating premiums, assessing claims, arranging and handling your insurance
4
Our own insurers and professional advisers, where necessary to obtain insurance or professional advice, establish or defend legal claims, comply with legal obligations, protect our interests, or manage business risks
5
Applicable regulators when requested, including the Financial Conduct Authority (FCA), the Financial Ombudsman Service, the Information Commissioner’s Office (ICO), and HM Revenue & Customs (HMRC)
We use third parties to enable us to provide our services. These may store personal data and include:
1
IT services and cloud storage providers
2
Marketing services providers
3
Client relationship management tools
4
Data analysis services
5
Payment processing services
6
Compliance and regulatory support services
We enter into agreements with all third-party data processors which state that personal data will not be processed for any purpose other than as stated in our privacy policies.
Where your data goes
International transfers of data outside the UK.
Some of our third-party service providers may store or process your data outside the UK. When this occurs, we ensure appropriate safeguards are in place through:
1
Standard contractual clauses approved by the UK government
2
Adequacy decisions where applicable
3
Additional technical and organisational security measures as needed
How long we keep it
Retention of personal data.
We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including:
1
Maintaining our business records for analysis and audit purposes
2
Complying with legal and regulatory record-keeping requirements
3
Defending or taking legal action
4
Managing complaints about our products and services
5
Assessing the effectiveness of our marketing and services
Typical retention periods:
1
Account data: minimum 7 years after closure
2
Incomplete applications: maximum 2 years, unless you opt in for marketing
3
Website data (cookies etc.): deleted when no longer required
4
Marketing data: until you withdraw consent or opt out
We may need to extend these periods to meet legal, regulatory requirements, or to handle ongoing queries or complaints.
Your control over your data
Your individual rights.
As a data subject, you have the following rights:
1
The right to be informed about our data processing activities, including through privacy notices such as this one.
2
The right of access to the personal information we hold about you. To request a copy of this information, you must make a subject access request to us in writing.
3
The right of rectification. You may ask us to correct any inaccurate or incomplete data within one month.
4
The right to erasure and to restrict processing. You have the right to have your personal data erased and to prevent processing, except where we have a legal obligation to process your personal information. Please bear in mind that by exercising this right you may hinder or prevent our ability to provide products and services.
5
The right to data portability. On your request, we will provide you with your personal data in a structured format.
6
The right to object. You have particular rights in relation to automated decision-making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention. You can object to your personal data being used for profiling, direct marketing or research purposes.
Where our processing is based on your consent, you can also withdraw that consent at any time.
To exercise these rights, contact us at privacy@vara.insure, or write to: Data Protection Representative, Vara Commercial Insurance, 101/6 Pearson Square, London, England, W1T 3BJ.
We may charge a reasonable fee for repeat requests, or refuse to respond if your request is manifestly unfounded or excessive.
If you’re unhappy
Complaints about your data.
You have the right to complain about how we handle your personal data. Please contact us first at privacy@vara.insure, or at the address noted above. We aim to resolve all complaints promptly and fairly.
If you’re not satisfied with our response, you can complain to the Information Commissioner’s Office (ICO). Website: www.ico.org.uk. Tel: 0303 123 1113.
Other websites
Links to third party websites.
Our website may contain links to other websites. Once you leave our website, we don’t have control over those websites. We’re not responsible for the protection and privacy of any information you provide while visiting third party websites, and such sites are not governed by this privacy notice.
Keeping this current
Changes to this privacy notice.
We may amend this privacy notice from time to time — for example, to keep it up to date or to comply with legal requirements. The latest version of this policy can always be found at vara.insure/privacy. Any changes will be posted there. This privacy notice is maintained by the Data Protection Representative of Vara. For questions about this privacy notice or our privacy practices, please contact privacy@vara.insure.
VARA
Vara Commercial Insurance · 0333 091 3663
Vara is a trading name of Koral AI Operating Company Limited. Vara is an appointed representative of Innovative Risk Labs Ltd, under Firm Reference Number 1060955. Innovative Risk Labs Ltd is authorised and regulated by the Financial Conduct Authority, under FRN 609155. We are registered in England and Wales under Registered Company Number 17256222.