TAX RETURNED PRIVACY POLICY
Contents
INTRODUCTION
CONTACT DETAILS
CHANGES TO THE PRIVACY POLICY AND YOUR DUTY TO INFORM US OF CHANGESRELATING TO YOU OR YOUR INFORMATION
INFORMATION WE COLLECT ABOUT YOU
IF YOU DO NOT PROVIDE INFORMATION THAT WE MAY NEED TO CARRY OUT OUR SERVICES FOR YOU
HOW WE COLLECT INFORMATION RELATING TO YOU
PURPOSES FOR WHICH WE WILL USE INFORMATION RELATING TO YOU
LEGAL GROUNDS FOR USING YOUR DATA
SENDING INFORMATION OUT
MARKETING
COMPLETING YOUR APPLICATION
SERVICE MESSAGES
COOKIES
CHANGE OF PURPOSE
DISCLOSURES OF INFORMATION RELATING TO YOU
INTERNATIONAL TRANSFERS
DATA SECURITY
OUR DATA RETENTION POLICY
YOUR LEGAL RIGHTS
GLOSSARY
INTRODUCTION
At Tax Returned Ltd we are committed to protecting the privacy of our clients and potential clients in all circumstances. This privacy policy explains how we collect and deal with information about you when you use our services, website, and/or app. Please review the terms of this policy and do not install the app on your device(s) unless you agree with the policy.
Our services, website, and/or app are not intended for children and we do not knowingly collect information relating to children.
It is important that you read this privacy policy together with any other privacy policy or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. If you provide us with data relating to your spouse/civil partner or any other person you should inform them about this privacy policy, although we will contact any such person directly to refer them to this privacy policy. This privacy policy supplements the other notices and is not intended to override them.
We have appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the data privacy manager using the details set out below.
CONTACT DETAILS
We are Tax Returned Limited, an English company number 08828062. Our postal address is PO Box 68031, London NW4 9JB.
We have a privacy manager called our Tax Returned Data Protection Manager. They can be contacted at dataprotection@getyourtaxreturned.co.uk.
CHANGES TO THE PRIVACY POLICY AND YOUR DUTY TO INFORM US OF CHANGESRELATING TO YOU OR YOUR INFORMATION
This privacy policy was last updated on 15th May 2019.
It is important that the information that we hold about you is accurate and current. Please keep us informed if it changes during your relationship with us.
We routinely update this privacy policy to clarify our practices and to reflect new or different privacy practices, such as when we add new services, functionality, or features. We will contact you to let you know about any significant updates.
INFORMATION WE COLLECT ABOUT YOU
In running and operating our services, website, and/or app we collect and utilise certain information relating to you and your use of our services, website, and/or app as follows:
- • Identity Data which includes first name, maiden name, last name, username or similar identifier, marital status, title, and date of birth, Employment History, Trade Union Memberships;
• Contact Data which includes postal address, email address and telephone numbers;
• Financial Data which includes National Insurance Number, Tax reference, Income Earned, partner/spousal income, Tax Calculations, bank details;
• Marriage Data which includes your marital status;
• Transaction Data which includes details about payments to and from you;
• Technical Data which includes your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system, platform, and other technology on the devices you use to access our services, website, and/or app;
• Profile Data which includes your username and password, your interests, preferences, feedback and survey responses;
• Usage Data which includes information about how you use our services, website, and/or app;
• Marketing and Communications Data which includes your preferences in receiving marketing from us and our third parties and your communication preferences.
The only Special Category of Personal Data that we will collect from you is your Trade Union Data and information about any same sex spouse/civil partner you may have, and only if you voluntarily give this data to us for the purposes of securing a refund for relevant fees and subscriptions and/or marriage allowance claims. We do not collect any other types of Special Category Data.
If you inadvertently or intentionally give other Special Category Data to us, you will be considered to have explicitly consented to us processing that data under Article 9(2)(a) of the General Data Protection Regulation. We will process that Special Category Data for the purpose of deleting it.
IF YOU DO NOT PROVIDE INFORMATION THAT WE MAY NEED TO CARRY OUT OUR SERVICES FOR YOU
Where we need to collect or deal with information relating to you – either by law or under the terms of a contract we have with you – and you fail to provide that information when requested (or your spouse/civil partner refuses to provide any personal data we may need for processing a claim in relation to marriage allowance), we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with a tax refund service). In this case, we may have to cancel the service you have with us, but we will notify you if this is the case at the time.
HOW WE COLLECT INFORMATION RELATING TO YOU
We use different methods to collect data from and about you, including through:
-
• Direct interactions. You may give us your Identity, Contact and Financial Data by using our app and/or filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
-
• apply for our services;
• subscribe to our service or publications;
• request marketing to be sent to you;
• give us some feedback.
• Automated technologies or interactions. As you interact with our website and/or app, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this information by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our cookie policy https://www.getyourtaxreturned.co.uk/cookies/ for further details.
• Third parties or publicly available sources. We may receive information relating to you from various third parties and public sources as set out below:
-
• Technical Data from the following parties:Analytics providers such as Google;
• Social Media platforms such as Facebook/ Snapchat
• Contact, Financial and Transaction Data from providers of technical, payment and delivery services such as PayPal, Sage Pay, AIB.
• Identity, Contact and Financial Data from HMRC
• Correspondence with clients through Facebook Messenger/ Email
PURPOSES FOR WHICH WE WILL USE INFORMATION RELATING TO YOU
-
• To register you as a new customer.
• To process your claim (or any claim your spouse/civil partner may make in relation to marriage allowance) and to get you the highest possible refund that you may be eligible for.
• To manage payments, fees and charges.
• To collect and recover money owed to us.
• To manage our relationship with you which will include: (a) Notifying you about changes to our terms or privacy policy, (b) Asking you to leave a review or take a survey and (c) Remind you to sign up for our services year on year.
• To enable you to complete a survey to allow us to improve our services.
• To administer and protect our business and this website and/or app (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data).
• To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you.
• To use data analytics to improve our website and/or app, services, marketing, customer relationships and experiences.
• To make suggestions and recommendations to you about services that may be of interest to you.
LEGAL GROUNDS FOR USING YOUR DATA
We will rely on the following legal bases under Article 6 of the General Data Protection Regulation for processing your personal data:
- • Consent – We will process your data where we were given your consent to do so (you may withdraw your consent at any time – see below);
• Contract – We will process your data for the performance of our contract with you, or in order to take steps at your request prior to you entering into a contract with us (this may include processing your claim, providing you with correspondence relevant to you from HMRC, or dealing with your correspondence);
• Legal Obligations – We will process your data where we have a legal obligation to do so (this may include provision of information to regulatory bodies or government agencies);
• Legitimate Interests – We will process your data where we or a third-party processor have a legitimate interest in doing so (this may include provision of administration and IT services, network security, the prevention of fraud, business analytics, marketing analytics, and the improvement of our services).
SENDING INFORMATION OUT
We have carefully selected GDPR-compliant processors to help us manage your claim. These include printing and postal delivery companies to distribute claim packs due to the high volume of claims we receive. These companies are both contractually obligated to protect your data under the terms of our agreements with them and subject to the GDPR themselves.
MARKETING
Tax Returned operates on an opt-in basis for marketing, in compliance with both PECR (The Privacy and Electronic Communications (EC Directive) Regulations 2003) and GDPR (General Data Protection Regulation). Tax Returned does not market third party services to its customers. If you consent to receiving marketing from us, we may contact you regarding additional services that we provide.
If you assign us as your tax agent, we will contact you regarding additional tax services related to your claim.
You may change your mind at any time about marketing communications you have opted into by utilising the opt-out links on marketing communications, or by contacting info@getyourtaxreturned.co.uk. However, if you opt-out of marketing communications from Tax Returned you will still receive service communications related to your ongoing contract with Tax Returned.
Tax Returned may offer prize draws. To enter a prize draw, you will be required to opt-in upon sign-up on the Tax Returned website and/or app. You can opt-out of all prize draws at any time by contacting us at info@getyourtaxreturned.co.uk.
Tax Returned uses pixels to identify social media traffic. Pixels show us what pages you have visited on our website, and we create custom marketing audiences on social media using this information. We do not receive any personal data through pixels. The platforms that we will market our services on are Facebook, Instagram, Google, Bing, Twitter, LinkedIn, and Snapchat. To opt-out from the pixel on those platforms you will need to go through the marketing preferences sections on those platforms.
COMPLETING YOUR APPLICATION
If you visit our website and/or app and drop off in the process of signing up to our services, we will use a third-party provider (Optalitix) to send you communications asking you if you would like to return and finish signing up. Our third-party service provider will send you two communications encouraging you to come back to complete your claim to the contact details you entered into our website and/or app before dropping off.
SERVICE MESSAGES
Tax Returned may send you service messages related to your claim. Service messages may include invoices and reminders. You may receive service messages regardless of whether you are opted into marketing or not.
COOKIES
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website [or the app] may become inaccessible or not function properly. For more information about the cookies we use, please see: https://www.getyourtaxreturned.co.uk/cookies/.
CHANGE OF PURPOSE
We will only use information relating to you for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please Contact us.
If we need to use information relating to you for an unrelated purpose, we will notify you and we will explain the legal reason which we believe allows us to use it in that way.
Please note that we may process information relating to you without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
DISCLOSURES OF INFORMATION RELATING TO YOU
We may have to share information relating to you with the parties set out below for the purposes explained above.
-
• Internal Third Parties (see the Glossary)
• External Third Parties (see the Glossary)
• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use information relating to you in the same way as set out in this privacy policy.
We require all these third parties to respect the security of information relating to you and to treat it in accordance with the law. We do not allow our third-party service providers to use information relating to you for their own purposes and we only permit them to deal with information relating to you for specified purposes and in accordance with our instructions.
Our app acts as a portal to allow you to view some of the data that we hold on you. Accessing your data through our app does not disclose your data to any third parties. Our app does not disclose all the data that we may hold on you, and your use of our app does not limit your right to request access to a copy of all the data that we hold on you.
INTERNATIONAL TRANSFERS
We may share information relating to you with employees and contractors that are based outside of the United Kingdom. This will involve transferring your data outside the European Economic Area (EEA) or secure third countries (designated as such by the European Commission).
Our employees and contractors in third countries that are not designated as secure by the European Union are bound under the standard contractual clauses issued by the European Commission. This ensures that your data is subject to the same protections it would receive within the European Union.
DATA SECURITY
We have put in place appropriate security measures to prevent any information relating to you from being accidentally lost, used, accessed, altered or disclosed in an unauthorised way. In addition, we limit access to information relating to you to those employees, agents, contractors and other third parties who have a business need to know. They will only process such information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected breach of security and will notify you and any applicable regulator of a breach where we are legally required to do so.
OUR DATA RETENTION POLICY
We have a legal obligation for tax purposes to retain basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers. For more information about data retention, please visit the data retention page on our website.
In some circumstances you can ask us to delete your data: see Request erasure below for further information.
In some circumstances we may anonymise information relating to you (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
YOUR LEGAL RIGHTS
Under certain circumstances, you have rights under data protection laws in relation to information relating to you. Please click on the links below to find out more about these rights:
-
• Your right to request access to information that we have relating to you;
• Your right to request correction of information that we have relating to you;
• Your right to request erasure of information that we have relating to you;
• Your right to object to processing of information that we have relating to you;
• Your right to request restriction of processing information that we have relating to you
• Your right to request transfer of information that we have relating to you;
• Your right to withdraw consent if you have previously given consent.
See the Glossary for details about each of these.
If you wish to exercise any of the rights set out above, please Contact us.
No fees: You will not have to pay a fee to access any information we have relating to you (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
Confirming your identity: We may need to request specific information from you to help us confirm your identity and ensure you are allowed to exercise any of the rights above. This is a security measure to ensure that we do not give out information relating to you to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Time limits: We will try to respond to all legitimate requests to access information as above within one month. Occasionally it may take us longer than a month if the request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
GLOSSARY
REGULATION
General Data Protection Regulation or GDPR means the EU Data Protection Regulation (EU) 2016/679 which is directly effective in the UK while the UK remains in the EU. When the UK leaves the EU, it may be effective through the separate, parallel channel of the Data Protection Act 2018 (which will continue to apply after Brexit, although the GDPR itself will not apply after Brexit).
The Privacy and Electronic Communications Regulations (PECR) sit alongside the Data Protection Act 2018 and the GDPR. They give people specific privacy rights in relation to electronic communications.
Secure third countries means the list of countries outside the European Union that are marked as secure for international data transfers by the European Commission. These countries are currently: Andorra, Argentina, Canada (only commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and the USA (if the recipient belongs to the Privacy Shield).
TECHNOLOGY
Pixel means a single pixel embedded in the code of a website or piece of digital content. When the content is loaded, the pixel is fired. This allows the owners of the pixel to see how many times and where their content has been accessed.
LAWFUL BASIS
Consent means processing your data where you have directly instructed or permitted us to do so.
Legitimate Interest means the interests of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we deal with information relating to you for our legitimate interests. We do not use information relating to you for activities where our interests are overridden by the impact on you (unless we are required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by Contacting us.
Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.
Comply with a legal or regulatory obligation means processing information relating to you where it is necessary for compliance with a legal or regulatory obligation that we are subject to.
THIRD PARTIES
Internal third parties means other companies in the same corporate group as Tax Returned Ltd [acting as joint controllers or processors] and who are based in the United Kingdom.
External third parties means:
-
• Data processors providing IT and business administration services who are based in the UK, EU, or secured third countries;
• Professional advisers including lawyers, bankers, auditors and insurers based in the UK who provide consultancy, banking, legal, insurance and accounting services;
• HM Revenue & Customs (HMRC), regulators and other authorities based in the UK who require reporting of processing activities.
YOUR LEGAL RIGHTS
You have the right to:
- • Request access to information relating to you (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. Click here (mailto: dataprotection@getyourtaxreturned.co.uk) to make a subject access request.
• Request correction of information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected, though we may need to verify the accuracy of the new information you provide to us.
• Request erasure of information relating to you. This enables you to ask us to delete or remove personal information relating to you where there is no good reason for us continuing to deal with it. You also have the right to ask us to delete or remove information relating to you where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase information relating to you to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of information relating to you where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing information relating to you for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Report us to the Information Commissioner’s Office. You have the right to lodge a complaint with the ICO if you believe that your personal data has not been treated with due care and respect in consideration of the GDPR (General Data Protection Regulation 2018), Data Protection Act 1998, PECR (The Privacy and Electronic Communications (EC Directive) Regulations 2003), or any other data privacy law. The ICO’s helpline is 0303 123 1113.
• Request restriction of processing of information relating to you. This enables you to ask us to suspend the processing of information relating to you in the following scenarios:
• ifyou want us to establish accuracy of the information;
• where our use of the information is unlawful but you do not want us to erase it;
• where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims; or
• you have objected to our use of the information but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of information relating to you or to a third party. We will provide to you, or a third party you have chosen, information relating to you in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process information relating to you. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.