Privacy policy

1. Who we are

VAT Recovery Ltd (“we”, “us”) is the data controller for the personal data described in this notice. We are registered in England and Wales under company number 14827396, at 3rd Floor, Devonshire House, 1 Mayfair Place, London, W1J 8AJ, United Kingdom, and registered with the Information Commissioner's Office under reference ZB612094.

Data protection enquiries: dpo@vatrecovery.co.uk or 020 3987 4410.

2. Personal data we collect

• Identity and contact data: your name, role, company name, email address, telephone number.
• Company and claim data: company registration number, VAT registration number, VAT returns, invoices, purchase records, accounting records and correspondence with HMRC.
• Correspondence: notes of calls, emails and messages you send us.
• Technical data: IP address, browser type, device information and pages viewed, collected through essential and analytics cookies (see our cookie policy).

3. Why we use it and our lawful basis

• To assess eligibility and respond to your enquiry — legitimate interests, and performance of a contract once you instruct us.
• To prepare, submit and progress a VAT recovery claim to HMRC — performance of a contract and compliance with legal obligations.
• To meet anti-money-laundering, tax, accounting and record-keeping duties — legal obligation.
• To send service updates and, where you have opted in, occasional relevant information — consent or legitimate interests. You may withdraw consent at any time.
• To defend or bring legal claims and manage complaints — legitimate interests.

4. Who we share it with

We share personal data with HM Revenue & Customs where required to submit or progress a claim; with your accountant or advisers where you ask us to; and with vetted service providers who act on our instructions (secure hosting, document storage, IT support, professional indemnity insurers, and our own legal or accounting advisers). We do not sell personal data or share it with third parties for their own marketing.

5. International transfers

Personal data is stored within the UK or European Economic Area wherever possible. Where a provider processes data outside those areas, we rely on UK adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

6. How long we keep it

Enquiries that do not proceed are deleted within 12 months. Where we act on a claim, we keep claim files and related records for seven years after the end of our engagement, to meet HMRC record-keeping, tax and professional obligations, after which records are securely deleted or anonymised.

7. Security

We use access controls, encryption in transit, restricted staff permissions, confidentiality obligations and regular reviews of our processors. No transmission over the internet can be guaranteed as fully secure; please do not send sensitive documents by unsecured email if we have offered a secure alternative.

8. Your rights

Under UK GDPR you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, or object to processing based on legitimate interests or direct marketing. To exercise a right, contact dpo@vatrecovery.co.uk. We respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), though we would appreciate the chance to resolve matters first.

9. Automated decision-making

We do not make decisions about your claim by solely automated means, and we do not carry out profiling that has a legal or similarly significant effect on you.

10. Changes to this notice

We may update this notice to reflect changes in our services or the law. The current version is always published on this page with the date it was last updated.