Version 1.0. Last updated 21/09/2026.
In short
- We collect what we need to check your eligibility, verify who you are and file your claim with HMRC.
- We never see or store your Government Gateway password.
- We share data with HMRC, our identity verification provider and our payment provider, and no one else without your consent.
- We keep claim records for 6 years after your last claim, as HMRC requires.
- Last updated: 21/09/2026.
1. What we collect
- Contact details: name, email, phone number, postal address.
- Identity: date of birth, National Insurance number, photo ID and a selfie for verification.
- Employment and tax data from HMRC via your authorised Gateway link: employers, income, tax paid, previous claims.
- Expense details you give us: mileage, uniform, tools, fees, home working.
- Bank account details for paying your refund.
- App and website usage data, and whether you arrived from one of our adverts. See cookies below.
2. Why we use it and our lawful basis
- To check eligibility and prepare your claim: performance of a contract.
- To verify your identity and prevent fraud: legal obligation (anti-money laundering) and legitimate interests.
- To act as your agent with HMRC: performance of a contract and legal obligation.
- To message you about your claim on WhatsApp, email or SMS: performance of a contract.
- To tell you about later years you could claim: legitimate interests, with an opt-out in every message.
3. Who we share it with
- HMRC, as your appointed agent.
- Identity verification: Sumsub.
- Payments: Stripe (card payments for fixed fees) and Revolut (paying refunds to your bank account).
- Messaging: Intercom (live chat and WhatsApp), Brevo (email) and ClickSend (text messages).
- Electronic signature of your agreement: SignWell.
- Cloud hosting: Supabase (database) and Vercel (app hosting).
We do not sell your data. Some of our providers store or access data outside the UK. When they do, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum approved by the ICO, and we check that the provider protects your data to UK standards. Ask us for details of the safeguard for any provider.
4. How long we keep it
Claim records and identity checks for 6 years after your last claim, in line with HMRC and anti-money laundering rules. Marketing preferences until you opt out. Enquiries that do not become claims: 12 months from your last contact with us.
5. Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to marketing, and complain to the Information Commissioner's Office at ico.org.uk. Email hello@taxpro.co.uk, marked for the attention of our data protection contact, and we respond within one month.
6. Cookies
Essential cookies to run the site and app. Analytics and advertising cookies only with your consent.
We use a cookie bar that asks before any analytics or advertising cookies are set. Choose "Essential only" to refuse them or "Allow all" to accept them.
- Essential: tp-consent, stored in your browser to remember your cookie choice, kept until you clear it.
- Analytics, only if you choose Allow all: Google Analytics through Google Tag Manager, cookies _ga and _ga_*, kept for up to 2 years.
- Advertising, only if you choose Allow all: Google Ads and the Meta (Facebook) Pixel through Google Tag Manager, used to measure which adverts lead to a claim. Cookies such as _gcl_au and _fbp, kept for up to 90 days.
- Reviews: the Trustpilot widgets load content from trustpilot.com.
You can change your choice at any time by clearing your browser storage for this site.
7. Contact
Tax Pro Group Limited, Ground Floor, 3 Mary Ann Street, Birmingham B3 1BG. hello@taxpro.co.uk. Data protection contact: Josh Hadley.