The policy should specifically say your personal data is not sold to other companies. It will also cover how long data is stored and specify your rights under UK data law, covering your right to view or erase your information. It’s worth reading so you understand where you stand.