Privacy Policy

California notice at collection

Best Group Benefits is a trade name of WJB Services, Inc. dba Bollinsure Insurance Services, an independent California insurance brokerage licensed by the California Department of Insurance under agency licence 0D94699. This section is the notice California requires us to give at or before the moment we collect anything from you. The rest of the page is the detail behind it.

We collect the categories listed below, for the purposes listed below, and we keep them for the periods set out under How long we keep it. We do not sell your personal information. We are a brokerage, not a lead aggregator: your quote request is not resold, auctioned, or passed to other agencies. We do run a Google Ads conversion tag on this site, and under California law passing an advertising identifier to Google can count as sharing personal information for cross-context behavioural advertising — so we do not claim otherwise. Do Not Sell or Share My Personal Information sets out exactly what that means and three ways to switch it off.

We do not ask for sensitive personal information anywhere on this site. No Social Security numbers, no driver’s licence numbers, no financial account or payment card numbers, no health conditions, diagnoses, prescriptions, or employee-level medical records. None of them are needed to price California small-group medical coverage. Please do not send them through this website.

What this site collects

Everything below comes from you or from your browser. There is no account to create and no login. Not every item applies to every request: the online form on the quote page asks for a subset of this, and the rest only comes up if you go on to get formal quotes and a broker asks you for it.

• Identifiers — your first and last name, your work email address, your phone number if you choose to give one, your company name, your business ZIP code, and the IP address your request arrives from. If you tick the optional box consenting to calls and texts, that IP address and the address of the page you were on are written into the consent record and kept with the file; see How long we keep it.
• California customer records (Civil Code section 1798.80) — the same name, telephone number and employment details, held as part of your record with the brokerage.
• Professional or employment information — your job title, your employer, your industry, and how many employees you want to cover.
• Commercial information — what you asked us to price: plan type, deductible level, add-on benefits such as dental, vision, life or disability, how much of the premium you intend to contribute, whether dependents are included, your budget, and the effective date you have in mind.
• Internet or other electronic network activity — which pages you viewed, the page that referred you, which quote, phone, email and broker-switch links you clicked together with their visible text and where on the page they sat, that the instant estimator was used, whether you started the quote form and the name of the first field you touched, the name (never the contents) of any field an error landed on, and whether you submitted it. The complete list of events is in Measurement, advertising and cookies.
• Geolocation — approximate city-and-region location, inferred from your IP address by our analytics providers. Not precise location. This site never asks your device for its location.
• Electronic signature and consent record — the name you typed as your signature, which authorization boxes you ticked and the exact wording you agreed to, and the date and time you submitted. If you tick the optional calls-and-texts box, we additionally record the number you consented to, the version of that wording, the moment you ticked it, the page you were on and the IP address it came from. That is the proof of consent the law puts on us rather than on you, and it is why those two items are kept rather than discarded.
• Inferences — we do not build profiles about you and we do not score you. If you are signed in to Google with ads personalization switched on, Google may draw its own inferences from your visit; see Measurement, advertising and cookies.
• Sensitive personal information — none requested, as above.

The instant estimator: what it sends, exactly. Step 1 on the quote page asks for four things — ZIP, headcount, age band, plan type. The arithmetic runs entirely inside your browser, and none of those four values is transmitted anywhere. They are not sent to us and not sent to any analytics provider. What is sent is one event, twice at most: estimate_viewed the first time a figure appears, and estimate_to_form if you click through to the form. Both go to Google Analytics through the tag manager and both are empty — they record that the estimator was used, and carry no ZIP, no headcount, no plan, no age band and no figure. Nothing from step 1 is stored when you close the tab. If you go on to submit the quote form, the ZIP, the headcount and the range you were shown are included with the submission, so the broker knows what number you had in front of you — that is the point at which they leave your browser, and only because you pressed submit.

Where the information comes from

• From you — everything you type into the quote form.
• From your browser, automatically — your IP address, the page you are on, the page that referred you, and the interaction events described below.
• From your current broker or carrier, only if you ask us to — if you sign a broker-of-record letter or ask us to look at the plan you already have, we request your current plan design, rates and enrollment counts from that carrier. We do not do this without your written authorization.
• Not from consumer reporting agencies — we do not order consumer reports, investigative consumer reports, credit-based insurance scores, or medical record retrievals to quote group health. California prices small-group medical on age, ZIP code and family tier, not on anyone’s health, so those reports are neither used nor needed. If that ever changes for a particular case, we will tell you in writing before we order anything.

How we use it

We use what you send to prepare a quote request, to obtain rate indications from the carriers we hold appointments with, to answer your questions, and to service coverage if you place it through us. We use the technical and analytics data to keep the site working, to stop automated abuse, and to see which pages produce enquiries. We do not use any of it to make an automated decision about you. And to say the important part plainly: an estimate on this site is not a quote, a submission through this site is not a bindable application, and no reply we send to a website submission is a policy, a binder, a quote, or an offer to insure. Nothing you do here places, changes, or continues coverage. Only a carrier can do that, in writing, on its own forms.

Who we share it with

• Insurance carriers and general agents — the carriers we hold appointments with, and the general agencies through which California small-group business is submitted, so they can return rates and issue coverage. They receive what a quote or an application needs and nothing more.
• Resend — our transactional email provider. Your quote request is delivered to our monitored agency mailbox, and your confirmation email is delivered to you, through Resend.
• Google — Google Tag Manager, Google Analytics 4 and Google Ads receive page views and the interaction events listed in the next section, and Google Fonts receives a request from your browser when a page loads. What each one gets, and the events by name, are set out there.
• Vercel — hosts this website. It sees the request logs that hosting necessarily involves, including your IP address. It does not run an analytics product here.
• Our own systems — quote requests are read by licensed staff of the brokerage and recorded in our internal agency management system.
• When the law requires it — in response to a subpoena, a regulator such as the California Department of Insurance, or another lawful demand.

Every service provider above handles your information under a contract that limits it to performing the service for us. We do not sell your personal information and we have never taken money for it.

Measurement, advertising and cookies

Here is everything this site loads. You can check it against the page source, which is why it is written down this precisely.

• Google Tag Manager, container GTM-5QM55LTJ — loads the tags below. It is on every page of this site.
• Google Analytics 4, property G-2C0V0NWB3Z — page views, referrers, approximate location from your IP address, and the interaction events this site pushes into the tag manager: quote_click, phone_click, email_click, bor_click, form_start (with the name of the first form field you touched), quote_click, phone_click and email_click (each with the first 40 characters of the link’s visible text and which part of the page it sat in). Every one of them also carries which of our brands the page belongs to and the path of the page. Nothing you type into a field is pushed. One further event exists in the shared script these pages load — a lead-conversion event carrying only the fact that a submission happened — but nothing on this site currently triggers it; if that changes, this bullet changes with it. Analytics normally sets first-party cookies on your device; whether it does depends on the consent state below.
• Google Ads conversion tracking, AW-18196791997 — configured in the container above so that we can tell which advertisements produce enquiries and stop paying for the ones that do not. This is the tag that raises the sharing question addressed in the next section.
• Google Fonts — the two typefaces this site uses are served by Google, which means your IP address reaches Google when a page loads.
• Consent Mode v2 — an inline script at the very top of every page, above the tag manager, sets the Google consent state before any tag can run. There is no cookie banner on this site and we are not going to add one; the default we set is granted for analytics and advertising storage, except where your browser sends a Global Privacy Control signal, in which case it is denied for all four of ad storage, ad user data, ad personalization and analytics storage. You can read that block in the page source of any page here — it is the first script after the brand line.
• Global Privacy Control — we treat a GPC signal from your browser as an opt-out request, not merely as a preference, and the previous bullet is the mechanism. See the next section.

And here is what does not run, so you do not have to wonder: no session recording, no heatmaps, no keystroke capture, no chat widget, no data-broker tag, no reCAPTCHA, and no Vercel Web Analytics or any other second analytics product — Google Analytics is the only measurement on this site. Automated submissions are handled by a hidden field on the quote form that no human ever sees — it is called website_url, it is in the page source, and anything that fills it in is discarded without an email being sent — and by a limit of ten submissions a minute from one IP address. Nothing else is loaded by this site’s own pages, and if we add something, this section changes before it goes live.

Do Not Sell or Share My Personal Information

We do not sell personal information for money. We have not, and we will not.

Sharing is the harder question and we are not going to fudge it. This site runs Google Ads conversion tracking. The Google tags on these pages pass an identifier associated with your browser to Google, which is how a visit can be connected back to an advertisement. California treats disclosing an identifier to an advertising company for cross-context behavioural advertising as sharing, whether or not money changes hands. Rather than argue about an exemption, we give you the control.

• Send a Global Privacy Control signal. We process opt-out preference signals, including GPC, as a valid request to opt out of the sale and sharing of personal information for the browser and device that sends it. Concretely: every page here reads navigator.globalPrivacyControl before the tag manager loads, and if it is set we deny ad storage, ad user data, ad personalization and analytics storage for that visit, so the Google tags cannot use cookies or identifiers for advertising. We process it in a frictionless manner: it costs you nothing, it does not change what you see on this site, we do not show you a pop-up asking you to reconsider, and there is no further step for you to take. GPC is built into some browsers and available as an extension for the rest.
• Tell us directly. Email reviews@bollinsure.com or call 562-COVWELL and say you want to opt out of the sale and sharing of your personal information. We will apply it to the record we hold and confirm when it is done. You do not need an account, and we will not ask you to make one.
• Turn it off at Google. Google’s own controls at myadcenter.google.com govern ads personalization across every site you visit, not only this one.

Opting out does not stop us quoting your group, does not change your price, and does not change the service you get. We will not treat you differently for exercising the right. We do not knowingly sell or share the personal information of anyone under 16.

How long we keep it

• Instant estimator inputs — never transmitted, so there is nothing to keep. They are gone when you close the tab. The two empty events recording that the estimator was used sit with the rest of the analytics data below.
• Rate-limiting record — your IP address and the times of your recent submissions are held in the server’s memory, and every entry older than 60 seconds is deleted the next time the form is used. Nothing is written to disk and nothing survives a restart.
• Quote requests, the signature record, and the emails they generate — kept while we are working with you, and then for five years after our last transaction with you, so that we can meet the recordkeeping obligations California places on a licensed insurance broker. Then they are deleted.
• Calls-and-texts consent record — if you tick that optional box, the record of it, including the number, the wording, the page and the IP address it came from, is kept with your file on the same five-year schedule. This is the one place an IP address is retained rather than dropped, and it is retained because the burden of proving you consented sits on us.
• Requests that never become a relationship — if you ask us to quote and nothing comes of it, the request is kept on the same five-year schedule, because it is still the record of an insurance transaction we were asked to perform.
• Correspondence — email you send us stays in the agency mailbox on the same five-year schedule as the file it belongs to.
• Analytics and advertising data — held by Google and by Vercel under their own retention settings and the retention period configured in our Google Analytics property. We do not keep a separate copy.

Security

The site is served over HTTPS, so what you type reaches us encrypted in transit, and it is stored encrypted at rest by our email provider and in our mailbox. That is not end-to-end encryption and we do not describe it as such: the request arrives as an email that licensed staff of this brokerage read, which is the whole point of sending it. Submissions are validated, limited to ten a minute from one IP address, and screened by a hidden field only automated scripts fill in. Access to quote requests is limited to licensed staff of the brokerage. No method of transmission or storage is perfectly secure, which is why the control that matters most is the one further up this page: we do not ask for Social Security numbers, financial account numbers, or medical information on this site, so there are none here to lose.

Your California privacy rights

Some of what we hold is regulated by the federal Gramm-Leach-Bliley Act and by California insurance privacy law rather than by the California Consumer Privacy Act. We offer the rights below regardless of which regime a particular record falls under, so that you do not have to work out which one applies before you ask. Where two sets of rules differ, we apply whichever gives you more.

• Know — the categories of personal information we have collected, the categories of sources it came from, the business purpose we collected it for, and the categories of third parties we disclosed it to.
• Know the specific pieces — not just the categories, but the actual information we hold about you.
• Portability — a copy in a readily usable format you can move elsewhere.
• Correct — inaccurate personal information we hold about you.
• Delete — subject to the exceptions the law allows, which here means chiefly the transaction records a licensed broker is required to retain. We will tell you specifically what we are keeping and why.
• Opt out of sale and sharing — three ways to do it are set out above.
• Limit the use of sensitive personal information — we do not collect any through this site, so there is nothing to limit. If that ever changes, this page changes first.
• Non-discrimination — we will not deny you service, charge you differently, or give you a lesser experience for exercising any of these.
• Use an authorized agent — you may have someone make a request for you.

How long we take. We confirm receipt of a request within 10 business days and respond substantively within 45 calendar days. If we need longer, we will tell you why inside that 45 days and take up to another 45.

How we verify you. We contact you at the email address or phone number already in our records and ask you to confirm details of the request that only the two of us would know. We ask for no more information than the verification needs, and we use what you send for verification and nothing else. If you use an authorized agent, we will ask for your signed permission and confirm with you directly before acting.

How to exercise your rights or reach us

• Email — reviews@bollinsure.com, with “Privacy request” in the subject line.
• Phone — 562-COVWELL, which is (562) 268-9355. A licensed member of staff answers during business hours. This is our office line and it is not toll-free; if you would rather not pay for the call, email us and we will call you back at our cost.
• Post — WJB Services, Inc. dba Bollinsure Insurance Services, 3625 E Thousand Oaks Blvd Ste 292, Westlake Village, CA 91362.

Your rights under California insurance privacy law

California’s Insurance Information and Privacy Protection Act — Insurance Code section 791 and following — applies to us as an insurance agent, separately from the CCPA and whatever our size. This section is our notice of information practices under it.

• Where information comes from. We may collect personal information about you and, if you place coverage, about the employees you enroll, from you, from your employees’ own enrollment forms, and — only with your written authorization — from your current broker or carrier. We do not use investigative consumer reports, credit-based insurance scores, or medical record retrievals to quote California group health, and we will notify you in writing before ever ordering one.
• What kind of information. Business and contact details, coverage preferences, enrollment information, and the records of the transaction itself. Employee enrollment information given to a carrier may include dates of birth and dependents, and where a carrier’s own form asks for it, medical information. That goes to the carrier on the carrier’s form. It does not come through this website.
• How it may be disclosed. To carriers, general agents and their service providers in order to obtain and service coverage; to people performing a business, professional or insurance function for us; and where the law requires or permits it. We do not disclose personal or privileged information collected in an insurance transaction so that another company can market to you.
• Access. You may ask us in writing to see the recorded personal information we hold about you. We will identify it, let you see and copy it, and tell you who we have disclosed it to. Medical information can be sent instead to a medical professional you name.
• Correction, amendment or deletion. If you tell us something we hold is wrong, we will correct it or tell you why we will not. If we correct it, we will notify you, and we will notify anyone we previously disclosed it to and any insurance-support organization that supplied it. If we refuse, you may file a concise statement of what you believe is correct, and we will include that statement with the information every time it is disclosed afterwards.
• Adverse underwriting decisions. If coverage is declined or terminated, or offered only on other than standard terms, you are entitled to a written statement of the specific reasons and of the information they rest on, together with the access and correction rights above. Ask us and we will obtain it for you.

Children

This site is for employers and the people who run them. It is not directed at anyone under 16, we do not knowingly collect personal information from anyone under 16, and we do not sell or share it. Minor dependents are enrolled on the carrier’s forms, never through this website.

Changes to this page

If our practices change, we will update this page and the date at the top of it before the change takes effect, and we will note anything material plainly at the top. We review this page at least once every twelve months whether or not anything has changed.

Contact

WJB Services, Inc. dba Bollinsure Insurance Services, doing business as Bollinsure — Best Group Benefits is its California group benefits practice.
3625 E Thousand Oaks Blvd Ste 292, Westlake Village, CA 91362
reviews@bollinsure.com · 562-COVWELL ((562) 268-9355)
California Department of Insurance agency licence 0D94699 — verify it yourself.