Privacy notice

This notice explains what personal data WiseReturn collects, why we need it, who we share it with, how long we keep it and what your rights are. It applies to this website, your WiseReturn account and our work on your claim. We have tried to keep it short and clear. If anything is unclear, please email us.

1. Who we are

WiseReturn is a trading name of Jack Tuckley, sole trader. He is the controller of your personal data, which means he decides how and why it is used and is responsible for protecting it. In this notice, “we”, “us” and “our” mean WiseReturn.

• Email: contact@wisereturn.co.uk
• Post: Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA

TODO(Jack): ICO registration number. It is shown here automatically once the icoStatus gate is on and the number is added to the site settings.

We are a small business and do not have a data protection officer. The owner deals with all data protection questions personally.

2. The personal data we collect

We only collect what we need for each stage of your claim.

When you create an account

• your email address
• the name you would like us to use, if you give one

When you tell us about your situation

• your answers to our questions: for example your job, employer and service, the courses and postings you attended, how you travelled, the general area of your main home, what you were paid back, and the tax years you want us to look at
• documents you upload, such as a JPA Course Booking Summary, Joining Instructions, Assignment Orders, payslips or JPA expenses history
• messages you send us through your account or by email

We do not ask for receipts at this stage. We only ask for them once you have agreed to go ahead and we know which ones we need.

If you decide to go ahead

• Identity details, which the law requires us to collect and check: your full name, date of birth, residential address and National Insurance number
• Results of identity checks, including checks against lists of politically exposed persons (PEPs) and the UK sanctions list. Our identity verification provider may also ask you for a photo of an identity document and a photo of yourself to compare with it.
• Your signature record: when you sign our terms on the website we keep the name you typed, the exact wording you agreed to, the date and time, your IP address and your device and browser type, as proof of the agreement
• Direct Debit details: Stripe collects your bank account details to set up the Direct Debit for our fee. We only see the last four digits of your account number and the status of the mandate.
• Receipts and other evidence we ask you for to support your claim
• Claim and fee records: the progress of your claim, what HMRC tells us, the amount HMRC pays you, our invoices and your payments

Technical data

• the cookies that keep you signed in (see our cookie notice)
• limited technical information that our hosting provider, Cloudflare, processes to deliver the website and protect it from attacks, such as your IP address and browser type

What we don’t collect

We never ask for your bank details to receive a refund: HMRC pays any refund directly to you. We don’t use analytics, advertising or tracking tools. We don’t ask for information about your health, religion, ethnicity or other special category data, so please don’t include it in your answers or documents. If a document you need to send contains information like this, tell us and we will explain how to cover it up.

3. Where we get your data from

Most of it comes from you. We also receive data from:

• our identity verification provider, which gives us the results of its checks
• HMRC, about your claim and any repayment
• Stripe, about your Direct Debit mandate and payments

4. How we use your data and our lawful basis

Data protection law says we must have a lawful basis for each way we use your data. These are ours.

Where identity screening shows information about criminal offences, for example a match on the sanctions list, we use it only as anti-money laundering law requires, under the conditions in Schedule 1 of the Data Protection Act 2018.

If you don’t give us information the law requires, such as your identity details, we can’t act for you.

No automated decisions

A person reviews every case and makes every decision about it. We do not make decisions about you by automated means, and we do not profile you.

No marketing

We don’t use your data for marketing, and we never sell it or share it for anyone else’s marketing. We only email you about your account and your claim.

5. Who we share your data with

We only share your data where we need to, and only what is needed.

• HMRC, to make your claim and deal with any questions about it.
• FigsFlow, our identity verification provider, which checks your identity and screens for PEP and sanctions status for us. TODO(Jack): confirm FigsFlow is the provider in use at launch, and update this line if you switch to Domus or TaxCalc.
• Stripe, which sets up the Direct Debit for our fee and collects it. Stripe uses some of this data for its own legal purposes, such as fraud prevention, as explained in Stripe’s privacy policy.
• Service providers who store or process data for us, under contracts that only let them use it on our instructions:
  • Supabase: our database, document storage and sign-in system, hosted in London
  • Cloudflare: website hosting, security and the bot check on our sign-in page
  • Namecheap: our business email
  • Resend: sends our service emails, such as updates on your claim and your copy of the terms you signed
• Professional advisers and insurers, such as a solicitor or our insurer, if we need their advice or have to make or defend a claim.
• Law enforcement, regulators and supervisors, such as the National Crime Agency or HMRC as our anti-money laundering supervisor, where the law requires us to.

If the business is ever sold or transferred, your data would pass to the new owner, who would have to protect it in the same way. We would tell you before this happened.

6. International transfers

Your account data and documents are stored in the UK. Some of our providers, such as Cloudflare, Stripe and Resend, may process data in other countries, including the United States. Where they do, the transfer is protected by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework for certified companies) or by the UK International Data Transfer Agreement or Addendum, which require your data to be protected to UK standards. TODO(Jack): confirm the transfer mechanism in each provider’s data processing terms.

7. How long we keep your data

You can ask us to delete your data sooner. We will, unless the law requires us to keep it.

8. How we protect your data

• Your data is encrypted when it is sent over the internet and when it is stored.
• Documents are kept in private storage. Only you and WiseReturn can open them.
• You sign in with a one-time link sent to your email, so there is no password to steal.
• Our own access to client records needs a second sign-in step with an authenticator app.
• Only the owner can see client records.

If something goes wrong with your data that is likely to put you at risk, we will tell you and the ICO as the law requires.

9. Your rights

You have the right to:

• access the personal data we hold about you and get a copy
• correct data that is wrong or incomplete
• erase your data, where we don’t need to keep it by law
• restrict how we use your data, for example while we check it is accurate
• object to us using your data on the basis of our legitimate interests
• data portability: receive data you gave us in a common electronic format, or have it sent to someone else

To use any of these rights, use the form in your account settings or email contact@wisereturn.co.uk. It is free. We may need to confirm your identity first. We will reply within one month, or tell you within that month if we need longer (up to two further months) for a complicated request. Some rights are limited where the law requires us to keep records, and we will explain if that applies.

10. Complaints

If you are unhappy with how we have used your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

11. Children

Our service is for people aged 16 or over. We don’t knowingly collect data from anyone younger.

12. Changes to this notice

We will update this notice if the way we use your data changes, and change the date at the top. If a change affects you significantly, we will tell you by email before it takes effect.