PLAIN-ENGLISH SUMMARY

We use your personal data to assess and progress your claim(s), communicate with you, and comply with legal and regulatory requirements.

• For HRP claims, any arrears are paid by DWP directly to you.
• We may ask you for the DWP arrears breakdown so we can calculate our success fee and issue an invoice.
• For Mileage Allowance claims, HMRC may pay refunds to us as your nominee so we can deduct our agreed fee and transfer the balance to you.
• We do not sell or rent your personal data.
• You can opt out of marketing at any time, and this will not affect service communications.

1. WHO WE ARE

1.1 Richmond Carter Ltd is a UK company. For the purposes of UK data protection law, we are the “data controller” for the personal data described in this Privacy Policy.

1.2 Company number: 13018050.

1.3 Registered address: 2nd Floor, 28a, Middle Hillgate, Stockport, SK1 3AY.

1.4 Contact details: info@richmondcarter.co.uk

1.5 Data protection contact (DPO inbox): dpo@richmondcarter.co.uk.

2. WHAT THIS NOTICE COVERS

2.1 This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the rights you have.

2.2 It applies when you contact us, use our website, sign up for our services, or when we receive your details from a third-party lead provider or introducer.

3. WHAT PERSONAL DATA WE COLLECT

3.1 Depending on the service and your circumstances, we may collect:

• Identity details: name, date of birth, National Insurance number, previous names (where relevant).
• Contact details: address, email address, phone number.
• Claim information (HRP): Child Benefit history, marital history, details of children relevant to HRP, State Pension details and relevant supporting information.
• Claim information (Mileage): employment details (including employer/payer name where relevant), travel/mileage details, payslips/P60/P45 and other supporting documents you provide.
• Authority documents and signatures: HMRC Form 64-8, DWP Letter of Authority (HRP), Conditional Fee Agreement (HRP), National Insurance Statement of Account (SoA) Request & Consent (HRP) (where applicable), CF411 HRP claim form (where submitted; signed later in the process), and other consent/authority forms you sign.
• Verification information: copies of identity and address documents and (where needed) bank details for repayments.
• Communications: emails, call notes, messages and correspondence between you and us.
• Website/technical data: IP address, device/browser information, and cookies/analytics data (see section 13).

3.2 We do not intentionally collect “special category” data (such as health information). If you choose to provide it and it is strictly necessary for your claim, we will handle it with additional care and only where permitted under UK GDPR.

4. HOW WE COLLECT YOUR DATA

4.1 We collect personal data:

• Directly from you (online forms, telephone calls, email, electronic signing via a secure link, and documents you provide).
• From third-party lead providers/introducers (where you have engaged with their advertising or have been referred).
• From HMRC and/or DWP once you have authorised us (for example, responding to requests for records or confirming case status).
• From service providers we use for identity checks, electronic signatures, IT and secure document processing (where applicable) including where we send you a secure link to review and sign documents

5. HOW WE USE YOUR PERSONAL DATA

5.1 We use your personal data to:

• Assess eligibility and progress your HRP and/or Mileage claim.
• Prepare and submit forms, letters and supporting documentation to HMRC and/or DWP as required.
• Communicate with you about your claim, including requesting documents, providing updates, and answering queries.
• Maintain audit trails for signed documents and electronic signature records (for example, date/time, transaction information and similar logs from our signature provider).
• Prevent and detect fraud and comply with anti-money laundering and other legal requirements (where applicable).
• Handle complaints, quality assurance, staff training and internal record keeping.

5.2 HRP (Home Responsibilities Protection) — important payment note

For HRP-related work, any arrears are paid by DWP directly to you (not to Richmond Carter). After arrears are paid, we may ask you for the DWP arrears breakdown/award notice so we can calculate our agreed success fee and issue an invoice in line with your Conditional Fee Agreement.

5.3 Mileage Allowance — nominee payment handling

For Mileage Allowance claims, HMRC may pay refunds to us as your nominee so we can deduct our agreed fee and transfer the balance to you. Before releasing any repayment to you, we may request proof of identity, proof of address and bank details to protect you and prevent fraud, as described in our Terms & Conditions.

6. OUR LAWFUL BASES FOR PROCESSING

6.1 UK GDPR requires us to have a lawful basis for processing personal data. Depending on the activity, we rely on one or more of the following:

• Contract (UK GDPR Art. 6(1)(b)) — to provide the services you request, including corresponding with HMRC/DWP and administering fees and invoices.
• Legal obligation (Art. 6(1)(c)) — to comply with legal, tax/accounting, fraud prevention and record-keeping requirements.
• Legitimate interests (Art. 6(1)(f)) — for case management, service improvement, safeguarding, and to maintain effective and secure operations (we balance these interests against your rights).
• Consent (Art. 6(1)(a)) — where required for certain types of marketing under UK GDPR and PECR.

6.2 Where we rely on consent for marketing, you can withdraw that consent at any time (see section 12).

7. WHO WE SHARE YOUR PERSONAL DATA WITH

7.1 We may share your data with the following categories of recipient, only where necessary and with appropriate safeguards:

• HMRC and DWP — to progress your claim(s), verify authority and respond to queries.
• Banks and payment services — to transfer funds and manage nominee payment handling (Mileage).
• IT and secure cloud/CRM providers — to store and manage your case securely.
• Electronic signature and document services — to capture signatures and maintain audit trails.
• Identity/verification providers — to help prevent fraud and verify identity where required.
• Professional advisers — such as accountants, auditors, compliance and legal advisers.

7.2 We do not sell your personal data.

7.3 Marketing partner (optional) — Tyler Hampshire Ltd (Tyler Media)

Where applicable and where lawful, we may share your contact details with our marketing partner, Tyler Hampshire Ltd (trading as Tyler Media), so they can send you useful financial updates, claims information and other offers. You can opt out at any time (see section 8).

7.4 Tyler Hampshire Ltd’s privacy policy is available at: https://tylerhampshire.uk/privacy-policy.

8. MARKETING AND SERVICE COMMUNICATIONS

8.1 Service communications: We may contact you by email, telephone and (where needed) SMS for service-related reasons such as updates, evidence requests, identity verification and fee/invoice communications. These are not marketing messages.

8.2 Marketing communications: Where we send marketing, or where our marketing partner sends marketing on our behalf, this will be done only where lawful under UK GDPR and PECR. You can opt out at any time.

8.3 How to opt out:

• Use the unsubscribe link in any marketing email; or
• Email dpo@richmondcarter.co.uk; or
• Email unsubscribe@tylerhampshire.uk (for Tyler Hampshire communications).

8.4 Opting out of marketing will not stop service communications about your claim.

9. HOW LONG WE KEEP YOUR DATA (RETENTION)

9.1 We keep your personal data only for as long as necessary for the purposes described in this Privacy Policy and to meet legal, regulatory and audit requirements.

9.2 As a general position, we retain case files and supporting evidence (including electronic signature audit trails/signing certificates where applicable) for 6 years from the later of: (a) closure of your case; or (b) the date any arrears/refund is paid (or, for nominee handling, the date funds are fully disbursed).

9.3 We may keep data longer where required by law, to deal with complaints, to defend legal claims, or where HMRC/DWP audit requirements apply.

10. INTERNATIONAL TRANSFERS

10.1 If we transfer personal data outside the UK, we will use a lawful transfer mechanism under UK GDPR (such as UK adequacy regulations, the ICO International Data Transfer Agreement (IDTA), or the UK Addendum to EU Standard Contractual Clauses) and complete a transfer risk assessment where required.

11. HOW WE KEEP YOUR DATA SECURE

11.1 We use appropriate technical and organisational measures designed to protect your personal data, including access controls, secure storage, encryption where appropriate, staff training and confidentiality obligations.

11.2 If a personal data breach occurs and we are legally required to do so, we will notify affected individuals and/or the Information Commissioner’s Office (ICO).

12. YOUR RIGHTS

12.1 You have rights under UK GDPR, including:

• Access — request a copy of your personal data (Subject Access Request).
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion in certain circumstances.
• Restriction — ask us to restrict processing in certain circumstances.
• Objection — object to processing based on legitimate interests in certain circumstances.
• Portability — request transfer of data to you or another organisation in certain circumstances.
• Withdraw consent — where we rely on consent (for example for marketing).

12.2 To exercise your rights, contact dpo@richmondcarter.co.uk. We will normally respond within one month.

12.3 If you are unhappy with how we handle your data, you can complain to the ICO at ico.org.uk or call 0303 123 1113. We would appreciate the opportunity to address your concerns first.

13. COOKIES AND ANALYTICS

13.1 Our website may use cookies and similar technologies (including analytics) to help us understand how our website is used and to improve it.

13.2 You can control cookies through your browser settings. Some cookies may be set by third-party providers (for example, analytics or advertising platforms) who process data under their own privacy policies.

14. CHANGES TO THIS PRIVACY POLICY

14.1 We may update this Privacy Policy from time to time. The latest version will be published on our website at: https://richmondcarter.co.uk/privacy-policy.

15. CONTACT US

15.1 If you have any questions about this Privacy Policy or how we use your personal data, please contact:

• Data protection contact: dpo@richmondcarter.co.uk
• General enquiries: info@richmondcarter.co.uk
• Address: Richmond Carter Ltd, 2nd Floor, 28a, Middle Hillgate, Stockport, SK1 3AY