This privacy policy explains what information HPB Assurance Limited collects and what the information is used for. If you have any question or concerns regarding this policy, please contact our Data Protection Officer, DPO@hpb.co.uk
We take your privacy seriously and we will only use your personal data in line with the provisions of data protection legislation.
Further information regarding Data Protection and your rights may be found on the Isle of Man Information Commissioners website www.inforights.im
We are HPB Assurance Limited (“HPBA”), a company incorporated on the Isle of Man whose registration number is: 021075C.
Our registered address is HPB Assurance Limited, 7th Floor, Anglo International House, Bank Hill, Douglas, Isle of Man, IM1 4LN.
We are registered with the Isle of Man Information Commissioner, and our registration number is N001368.
The website for HPB Assurance Limited is www.HPBA.co.im
We are part of the Quality Holidays Assured Limited group of companies. You can find
more information about the other companies in our group here.
In order to provide you with our products and services we need to collect, use, share and
store personal and financial information about you.
Our lawful basis for processing your personal data is in the pursuance of fulfilling the contractual obligations of a Holiday Property Bond policy and to fulfil our legal obligations.
We will not ask for more information than we need for the purposes for which we are collecting it.
Your details are collected when you complete forms, contact us or request information by letter, telephone or send us an e-mail.
We do not use cookies on our website. Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may use cookies, however we do not have any control over them.
We may use any information you give us about yourself and others to:
Manage your Bond;
Carry out regulatory checks to meet our legal obligations;
Prevent and detect crime (including without limitation fraud, money laundering
and terrorist financing);
Keep you up to date with information about your Bond;
Undertake assessment and statistical analysis.
If we are given false or inaccurate information or we suspect fraud, we will record this.
The personal data (including special categories of data such as health information and copy proofs of identity and address) provided to us when you apply to become a Holiday Property Bondholder is used to:
Assess the application;
Form the basis of the contract between you and HPBA;
Confirm compliance with Anti-Money Laundering and Countering the Financing of Terrorism regulations and guidelines. This may involve carrying out checks with credit reference agencies and other specialised databases in order to comply with our regulatory obligations.
We need to handle your personal data in this way to fulfil the contract in place between
us.
The personal data (including special categories of data such as health information) provided to us when you are proposed as a Holiday Property Bondholder Additional Life Assured is used to:
Assess the application;
Fulfil the contract between the Holiday Property Bondholder and HPBA. There is
no contract between yourself and HPBA, all ongoing communication in
connection with the administration of the Holiday Property Bond will be between the Holiday Property Bondholder and HPBA.
We will share information with HPB Management Limited ("HPBM") who act as our agent in the marketing of the Holiday Property Bond and the provision of the holiday rights included within the Holiday Property Bond.
This is particularly useful in keeping your personal data accurate;
We will also have records of future holidays made under your Bond disclosed to
us so that we can undertake policy surrenders, and other processes effectively.
We need to handle your personal data in this way to fulfil the contract in place between
us.
When you phone us, we will normally ask you to confirm any requests or changes in writing, although some day-to-day matters can be handled by telephone once your identity has been confirmed.
A note of your phone call, along with the details of the matter that you contacted us about, will be retained.
If you phone us in connection with the services you have asked us to provide, we need to handle your personal data in this way to fulfil the contract in place between us. Where you contact us with a more general query, we rely on your consent to handle any new personal information in this way, and you can withdraw your consent at any time by contacting us.
We treat all information we hold about you as private and confidential. We will not reveal any personal details or details concerning your Holiday Property Bond to anyone not connected with the Quality Holiday Assured Limited group of companies, unless:
You ask us to reveal information, or we have your permission to do so;
We are required or permitted to do so by law, including meeting our regulatory obligations;
It is required by law enforcement, fraud prevention or credit reference agencies;
There is a duty to the public to reveal the information e.g. to governmental bodies, tax authorities or regulatory bodies.
To complete and service your policy we are required to share your personal information with selected third parties, or those who are acting as our agents, to perform tasks for us to help service your Bond. These include payment providers; credit reference, identity checking and other agencies who we may use for the provision of information to assess fraud, credit and/or other security risks. We will ensure that these third parties agree to treat your data with the same level of protection as if we were dealing with it. We handle your personal information in this way to fulfil the contract in place between us.
To prevent and detect fraud we may share your data with other organisations, including the police, and check and/or file your data with fraud prevention agencies and databases. We handle your personal information in this way because we have a legal obligation to reduce fraudulent activity across our services.
We do not sell or use your information for marketing purposes.
The data that we collect from you is securely stored in the UK on cloud-based servers. Data collected during the course of identity checking is securely stored in Dublin and Frankfurt. This data is deleted after 14 days.
We will ensure that we have appropriate physical and technological security measures to protect your information regardless of where it is held.
When we outsource any processes, we will ensure that the supplier has appropriate security measures in place and will contractually require them to comply with data protection legislation.
We will ensure that suitable safeguards are in place before personal information is transferred to other countries.
We will retain your data for legal purposes for a period of at least six full tax years from the date the record was created or, if later, at least six years from the date that it ceases to be relevant (such as when you are no longer a Bondholder).
You are entitled to receive confirmation as to whether your personal information is being processed by us, as well as supplementary information relating to our use of your personal information.
You also have the right to access your personal information which we are handling.
Your right of access allows you to be aware of and verify the lawfulness of the processing of your data.
You can exercise this right by contacting us. The easiest way is by email at info@hpb.co.im
You have the right to require us to correct any inaccurate personal information we hold about you. You also have the right to have incomplete personal information we hold about you rectified, by providing a supplementary statement to us.
The right to erasure does not provide an absolute ‘right to be forgotten’.
You have the right to request the erasure of your personal information which we are handling, and to prevent the processing of your data in the following specific circumstances:
we no longer need to use your personal information for the reasons which we told you we collected and processed it;
where we needed your consent to use your personal information and you have withdrawn your consent;
you object to our use of your personal information and we have no overriding legitimate reason for continuing the processing of your personal information;
our handling of your personal information was unlawful;
we must erase your personal information to comply with any legal obligation we are subject to.
You can restrict our processing of your personal information where:
you think we hold inaccurate personal information about you, until the accuracy
of your personal data has been verified;
our handling of your personal information breaks the law, but you do not want us to delete it;
we no longer need to process your personal information, but you want us to keep it for legal reasons;
you have objected to the processing (where it is necessary for the purpose of legitimate interests or the performance of a public interest task), and we are considering whether HPBA’s legitimate grounds override those of yours.
Where you exercise your right to restrict us from using your personal information, we will then only process your personal information when you agree, except for storage purposes and to handle legal claims.
In certain circumstances you have the right to receive the personal information held about you in a structured, standard machine-readable format and to send this to another organisation controlling your personal information.
In most circumstances we are handling your personal information pursuant to our contractual and legal obligations.
You have the right to object to us handling your personal information when:
We are handling your personal information based on legitimate interests;
If we use it for marketing purposes;
If we process your data for the purposes of scientific/historical research and
statistics.
If you ask us to stop handling your personal data in this way, we will stop unless we can show you that we have compelling grounds as to why our use of your personal information should continue.
We undertake limited - automated decision making (making a decision solely by automated means without any human involvement) when verifying ID digitally. If the automated system initially decides to reject any data, this is always referred to a human for a final decision.
We do not undertake profiling (automated processing of personal data to evaluate certain
things about an individual).
HPBA has appointed HPB Management Limited, our UK agents, as its EU nominated representative in relation to Data Protection.
As a result of that you will have the right to lodge a complaint with the UK’s Information Commissioner's Office, the supervisory authority for data protection issues in England and Wales. This is in addition to your right to complain to the Isle of Man Information Commissioner.
Our site contains links to the websites of other companies in the Quality Holidays Assured Limited Group. If you follow a link to any of these websites, please note that you have left our site and these websites have their own privacy policies.
We do not accept any responsibility or liability for these policies or websites. Please check their policies before you submit any personal information to these websites.
We will transfer your personal information to a third party:
if we sell or buy any business or assets, we will provide your personal information to the seller or buyer (but only to the extent we need to, and always in accordance with data protection legislation); or
if HPBA or the majority of its assets are acquired by somebody else, in which case the personal information held by HPBA will be transferred to the buyer.
We process your personal information for this purpose because we have a legitimate interest to ensure our business can be continued by the buyer. If you object to our use of your personal information in this way, the relevant seller or buyer of our business may not be able to provide services to you.
In some circumstances we may also need to share your personal information if we are under a duty to disclose or share it to comply with a legal obligation.
We keep our privacy notice under regular review. Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail or post.
Please check back frequently to see any updates or changes to our privacy policy. This privacy policy was last updated on 21 May 2026.
Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to DPO@hpb.co.uk
The registered and Head Office of HPB Assurance Limited is:
7th Floor Anglo International House, Bank Hill
Douglas Isle of Man
British Isles IM1 4LN
You have a right to access the personal data held about you. To obtain a copy of the personal information we hold about you, please email DPO@hpb.co.uk or write to the Data Protection Officer at our Isle of Man address shown above.