Privacy Policy

1. Introduction & Scope

We are committed to protecting your privacy and complying with applicable data protection laws (including UK GDPR and Data Protection Act). This Policy describes how we collect, use, store, share, and protect your personal data when you use our website, portal, or Service.

When we refer to "you", we mean the user or prospective user of our Service.

2. What Data We Collect

We may collect your personal data in various ways, including:

• Account / Registration Data: name, email address, password (hashed), postcode, contact details.
• Identity & Verification Data: copy of identity documents (passport, driving license), national insurance number, employer data.
• Employment & Income Data: payslips, contracts, tax records, salary, working hours.
• Usage & Technical Data: IP address, device type, browser, operating system, pages visited, timestamps, log data.
• Communications Data: any messages you send us (support, feedback, queries).
• Derived / Analytical Data: data generated by our system based on your uploads and usage (e.g. claim eligibility, risk scoring).

We collect data directly from you, automatically via our systems, or via third parties (with your consent or under agreement).

3. Purposes & Legal Bases for Processing

We process your data for the following purposes (with the legal basis for each):

Where we rely on legitimate interest, we ensure that our interest is balanced against your rights; we will not use your data in ways you would not reasonably expect.

4. Sharing & Disclosure of Data

We may share your personal data under the following circumstances:

• Service Providers / Processors. Third-party vendors who assist with hosting, analytics, payment processing, email, or support. We require them to act only per our instructions and to maintain confidentiality.
• Law Enforcement, Regulators & Legal Requests. If required by law, court order, or government request.
• Business Transfers. In event of merger, acquisition or sale of assets, your data may be transferred, subject to notice.
• Aggregated / Anonymised Data. We may share non-identifiable analytics for research or public reporting.

We never sell your personal data for direct marketing profit.

5. Data Retention & Deletion

We retain your personal data only as long as necessary for the purposes outlined (e.g. active subscription, legal obligations).

After you cancel, we may retain certain data for a limited period (e.g. 6–7 years) to comply with accounting, tax or legal obligations.

When no longer needed, we will securely delete or anonymise your data.

You may request deletion (subject to legal or contractual constraints).

6. Security & Safeguards

We employ industry-standard technical and organizational security measures (encryption, access controls, secure servers, regular security audits).

While we strive to protect your data, no system is perfectly secure. We cannot guarantee absolute security.

In the event of a data breach, we will comply with applicable notification obligations.

7. International Transfers

If we transfer your data outside the UK or European Economic Area, we will ensure appropriate safeguards (e.g. adequacy decisions, Standard Contractual Clauses, binding corporate rules) per applicable law.

8. Your Rights

Under data protection law, you have rights including:

• Access / Subject Access Request: receive a copy of your personal data.
• Correction / Rectification: ask us to correct inaccurate or incomplete data.
• Deletion / Erasure ("right to be forgotten"): subject to limitations (e.g. legal obligations).
• Restriction of Processing: request to restrict processing in certain circumstances.
• Data Portability: receive data in machine-readable form or transfer to another provider (where applicable).
• Objection: object to processing based on legitimate interest or direct marketing.
• Withdraw Consent: where we process based on consent, you may withdraw at any time (without affecting prior processing).

To exercise any of these rights, contact us at [email protected]. We may ask you to verify your identity before acting.

9. Cookies, Tracking & Analytics

We use cookies, web beacons, and similar tracking technologies to collect usage and technical data (see our Cookie Policy for details).

10. Changes to This Policy

We may update this Policy from time to time (e.g. to reflect changes in law or practices). Material changes will be notified to you (e.g. via email or banner) before taking effect.

11. Contact Us

If you have questions, concerns, or requests about this Policy or our data practices, please contact: