Privacy Policy

Alfred Wholesale Limited

Last updated: 15 July 2026

This policy explains how Alfred collects, uses and protects your personal data. We’ve written it to be readable — not to bury things in legal language. If something isn’t clear, get in touch.

1. Introduction

Alfred Wholesale Limited is committed to protecting your privacy and handling your personal data responsibly. This policy explains what we collect, why we collect it, how we use it, and what your rights are.

It applies whenever you interact with Alfred: through our website, app, or membership services.

We may update this policy from time to time. When we make bigger changes, we’ll let you know by email or through the app. Please read and keep this notice so you understand how your data is handled and what rights you have under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

Alfred Wholesale Limited is the data controller for most of the personal data described in this policy. Alfred Cover Limited (Alfred’s insurance arm) acts as a separate data controller in connection with insurance services. Where it’s relevant, we’ve noted which entity is responsible in each section.

2. Our approach to data protection

We follow UK data protection law. That means the personal data we hold about you must be:

• collected and used lawfully, fairly and transparently
• limited to what’s needed for a clear, stated purpose
• accurate and kept up to date
• kept only for as long as necessary
• kept securely

3. How we use your personal data

We only use your personal data when the law allows. The legal bases we rely on are:

• Consent — where you’ve actively agreed, such as opting in to marketing communications or taking part in research.
• Contractual obligation — where we need it to deliver your membership, process payments, or manage your services.
• Legal compliance — where we’re required to retain or share data by law, such as financial records or fraud reporting.
• Legitimate interest — where it’s reasonably necessary for our business, and doesn’t override your rights, such as improving our products based on usage patterns.

4. What data we collect

We collect the categories of data listed below. Not every type will be collected from every person — this is the full picture of what we may hold:

• Contact details — name, email address, phone number and postal address
• Account information — login credentials, membership status and preferences
• Payment and billing information — direct debit mandates, card details and transaction history
• Service data — which services you use, usage levels and support history
• Device and technical data — IP address, device type, browser type and app usage
• Research and feedback data — survey responses, interview recordings and usability testing data
• Communications data — records of correspondence and support interactions
• Marketing preferences — opt-in status and preferred contact channels

5. When we collect your data and why

The table below sets out each category of personal data we collect, the purpose for which we use it, and the legal basis we rely on. (See Section 3 for a fuller explanation of those legal bases.)

6. Customer research

We conduct research to improve our products, services and user experience. This may include surveys, interviews, usability testing and journey-mapping exercises.

Where research is conducted by a third-party partner on our behalf, that partner acts as our data processor under a data processing agreement. They handle your data only according to our instructions and applicable law.

Taking part in research is always voluntary. Where we rely on consent as our legal basis for a research activity, you can withdraw that consent at any time — without affecting the lawfulness of anything we’d already done.

Research may involve audio or video recordings, written responses and behavioural observations. We’ll always tell you at the point of collection what’s being gathered and how it will be used.

7. Change of purpose

We only use your personal data for the purposes it was collected for — unless we have a good reason to use it for something else that’s compatible with the original purpose. If we need to use it for an unrelated purpose, we’ll let you know and explain the legal basis.

In some circumstances the law may allow us to process your data without your knowledge or consent. We’ll always act within those rules.

8. Our service partners

Alfred works with established UK network and supply partners to deliver your home services. These partners may process your personal data to the extent needed to fulfil your service requests. They act either as data processors (operating under our instructions) or, in some cases, as independent data controllers.

Alfred Cover Limited (Company No. 16660851, FRN: 1051888) is an appointed representative of PHL Insurance Brokers Ltd (FRN: 301732), which is authorised and regulated by the Financial Conduct Authority. Alfred Cover Limited acts as the data controller for personal data processed in connection with insurance services.

We also work with technology providers, customer support platforms, analytics services and payment processors as data processors. Alfred's payments are processed by GoCardless, who use personal data as described in their Privacy Policy. We require all third-party processors to maintain appropriate security measures and handle your data in line with data protection law.

AI-assisted support

When you message us in the app, we use AI to help us understand and reply to you faster. To do that, we send the AI what you write, plus a few details that help us match it to your account: an Alfred account ID, your name, your mobile number, your device type and your app version. We use this only to handle your message and reply. It's never used to train AI models, and we keep it only as long as we need to.

The AI runs on Amazon Web Services (Bedrock), and your data is processed in the UK. Amazon acts as our data processor — they only handle your data on our instructions, under a contract that holds them to the same data protection standards we follow.

9. Digital advertising and analytics

When you visit our website or interact with our digital channels, we may use tracking technologies (including pixels and cookies) operated by advertising platforms including Meta, Google and LinkedIn. These help us understand how people find and use Alfred, and to show relevant advertising to people who may be interested in our services.

You can manage your cookie preferences through our cookie settings. For more on how we use cookies, see our Cookie Policy.

10. Sharing your data

We share your personal data only where we need to, and always in accordance with the UK GDPR. The third parties we may share it with include:

• Service partners who deliver the home services available through your Alfred membership
• Technology providers, payment processors, analytics services and customer support platforms acting as our processors
• Research partners conducting user research or surveys on our behalf
• Other entities in our group, where relevant
• Parties involved in a possible sale or restructure of the business (we would share anonymised data where possible until any transaction completes)
• Regulators, law enforcement or other bodies where required by law or to protect our legal rights
• AI service providers who help us understand and respond to your in-app support messages, where we share only the limited data described in Section 8

If you want to know which third parties have access to your personal data, contact us using the details at the end of this policy.

11. International transfers

Where we transfer your personal data outside the UK, we ensure it receives an equivalent level of protection. We do this through appropriate safeguards such as International Data Transfer Agreements (IDTAs) or transfers to countries with an adequacy decision from the UK government.

12. Data security

We have appropriate technical and organisational measures in place to protect your personal data from accidental loss, unauthorised access, alteration or disclosure. Access is limited to those with a genuine business need, who process it only under our instructions and are subject to a duty of confidentiality.

If any data is shared with third parties, we require the same standards of them.

13. How long we keep your data

We keep personal data only for as long as needed for its original purpose, or to meet legal, regulatory or reporting requirements. In practice:

• Account and identity data: retained for 6 years after account closure
• Payment and billing records: retained for 6 years (legal and tax compliance)
• Insurance-related data: retained for 6 years post policy expiry
• Marketing preferences: retained for the duration of active membership, and for 2 years following cancellation, unless you unsubscribe earlier.
• Waitlist data: if you signed up to the Alfred waitlist but never became a member, we will retain your data for 2 years following sign-up.

Where data is no longer needed, we delete or anonymise it. Anonymised data may be used for analysis or reporting without further notice.

14. Children’s data

Alfred’s services are intended for adults. We do not knowingly collect or process personal data relating to anyone under 18. If you believe we have inadvertently collected data relating to a child, please contact us and we will delete it promptly.

15. Automated decision-making

We do not currently use automated decision-making or profiling in a way that produces legal or similarly significant effects for individuals. We do standard checks to make sure you can pay your bill and protect our services from fraud. If this changes, we will update this policy and notify you accordingly.

16. Keeping your data accurate

The personal data we hold about you should be accurate and up to date. Please let us know if your details change so we can update our records.

17. Your rights

Under UK data protection law, you have the following rights in connection with your personal data:

• Right of access — to receive a copy of the personal data we hold about you and check we’re using it lawfully (a “data subject access request”).
• Right to correction — to have inaccurate or incomplete data corrected.
• Right to erasure — to ask us to delete your data where there’s no good reason to keep it, or where you’ve objected to processing.
• Right to object — to processing based on legitimate interest, or to direct marketing at any time.
• Right to restrict processing — to ask us to pause processing, for example while we verify its accuracy.
• Right to portability — to receive your data in a structured, commonly used format, or have it transferred to another organisation.

To exercise any of these rights, contact us using the details in Section 19.

We don’t charge for handling data rights requests, unless a request is clearly unfounded or excessive. In those cases, we may charge a reasonable fee or decline the request. We may need to verify your identity before responding.

18. Withdrawing consent

Where we rely on your consent to process personal data, you can withdraw it at any time. Withdrawal won’t affect the lawfulness of anything we’ve done before you withdraw. Contact us using the details below, and we’ll stop processing for that purpose (unless we have another lawful basis to continue).

19. How to contact us

If you have a question about this policy, want to exercise your data rights, or have a concern about how we’ve handled your information, get in touch:

If you’re not satisfied with how we’ve handled a concern, you always have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

20. Deleting your account

You can delete your Alfred account at any time, directly in the app. Go to Profile, select "Delete account," and confirm. This permanently removes your account and the personal data associated with it.

If you'd prefer, you can also request deletion by emailing us at hello@alfred.co.uk from the address linked to your account. We may ask you to confirm it's you first.

When you delete your account, we remove your personal data within 30 days. Some information may be kept for longer where the law requires it — for example, payment and billing records, which we retain for 6 years for tax and compliance purposes (see Section 13). Anything we're not legally required to keep is deleted or anonymised.

Alfred Wholesale Limited | Registered in England and Wales | Company No. 16293586 | 9 Thorney Leys Park, Witney, Oxfordshire, OX28 4GE