Privacy Policy

1. Who we are

FamilyRefund is a trading name of Harbour Tax Refunds Ltd, a company registered in England and Wales (company number 99759437), registered office Manchester, UK. We are the data controller for the personal data described in this policy and are registered with the Information Commissioner's Office (ICO) under registration number Z5578213.

Questions about this policy or your data: email privacy@familyrefund.com or write to our Data Protection Lead (Alex S. Morgan) at the address above.

We are an independent company. We are not part of, or affiliated with, HMRC, the Department for Education or any other government body.

2. The information we collect

Information you give us

• About you: your name, date of birth, National Insurance number, email address, phone number (optional) and home address.
• About your situation: your answers to our eligibility questions (where you live, how many children you have, whether you or your partner work and earn under £100,000), and optionally your relationship status, work status and income band.
• About your children: each child's name and date of birth.
• Your choices: which consent boxes you ticked, when, and the version of this policy you saw.
• Correspondence and documents: emails, notes of phone calls and documents you send us, such as P60s, payslips, childcare invoices, marriage or civil partnership certificates and HMRC letters.
• Data rights requests: the details you give us when you use our data rights form.

Information we collect automatically

• Technical data: your IP address and browser/device type when you submit a form (to protect against fraud and to evidence your consent).
• Where you came from: the website or advert that referred you (for example UTM campaign tags and advert click IDs).
• Usage data: anonymous counts of how many people reach each step of our eligibility check. These contain no personal data and use no cookies.
• Cookies: essential cookies, plus analytics and marketing cookies only if you agree. See our Cookie Policy.
• Email engagement: whether our emails were delivered, opened or clicked, so we know they reached you.

Information from others

If you ask us to make claims for you, we receive information from HMRC and the Childcare Service about your tax position and claims. We may check your postcode against public Ordnance Survey/ONS data (via postcodes.io) to confirm it is in England — only the postcode is sent.

3. Your children's information

We collect information about children only from their parent or carer, never directly from children. We use it only to work out which schemes your family can get (for example, Tax-Free Childcare depends on a child's age) and to make claims you ask us to make. We never use children's information for marketing or profiling, and we never share it with marketing partners. When you give us details of your children or your partner, please let them know (where appropriate) and point them to this policy.

4. How we use your information and our lawful bases

We don't ask for special category data (such as health information). Your National Insurance number isn't special category data, but we treat it as highly sensitive: it is encrypted at rest and only revealed to authorised staff when needed, with every view logged.

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for details and you can object at any time (see section 10).

5. Automated estimates

Our eligibility check uses fixed rules (for example, scheme amounts and your children's ages) to calculate an estimate instantly. The estimate doesn't make any decision about you with legal or similarly significant effects: a member of our team reviews your details before any claim is made, and the final decision on any claim is made by HMRC or the relevant government department. We also give each enquiry a priority score so our team knows whom to call first. You can ask for a person to review anything about how your enquiry was handled.

6. Who we share your information with

• HMRC, the Department for Education and the Childcare Service — only when you ask us to make a claim and have authorised us to act for you.
• Our service providers (processors) who act only on our instructions: secure hosting in the UK/EU (Cloudflare), email delivery (Resend), bot protection (Cloudflare Turnstile), error monitoring (Sentry — configured not to receive personal data), and, only with your cookie consent, analytics (PostHog, EU-hosted) and advert measurement (Meta).
• Our professional advisers, such as accountants, lawyers and insurers, under confidentiality duties.
• Partners — only if you tick the optional box. We share your name and contact details (never your NI number, financial details or your children's details) with carefully selected partners such as childcare providers. Ask us for the current list at privacy@familyrefund.com.
• Law enforcement, regulators and courts where the law requires it.
• A buyer of our business, if it is sold, who would have to protect your data in the same way.

We never sell your personal data.

7. International transfers

We store your data in the UK or the European Economic Area. Some service providers (for example email delivery) are based in, or may access data from, the United States. Where data leaves the UK we make sure it is protected — through the UK–US Data Bridge, UK adequacy regulations, or the ICO's International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

8. How long we keep your information

“Anonymised” means we remove everything that could identify you and keep only statistics.

9. How we protect your information

• All connections to our website use HTTPS (TLS) encryption.
• National Insurance numbers and documents are encrypted at rest with AES-256-GCM.
• Staff access is limited to people who need it, protected by strong passwords, account lockout and optional two-factor authentication, and every sensitive action is recorded in a tamper-resistant audit log.
• Backups are encrypted and stored securely.
• Our team is trained in data protection and confidentiality.

If a breach ever put your rights at high risk, we would tell you and the ICO as the law requires.

10. Your rights

Under UK data protection law you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted where there is no good reason for us to keep it.
• Restriction — ask us to pause using your data.
• Portability — receive data you gave us in a machine-readable format (we provide JSON).
• Objection — object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — at any time, without affecting what we did before.

Use our data rights form or email privacy@familyrefund.com. It's free. We will reply within one month (or tell you within that month if we need up to two more months for a complex request). We may ask you to confirm your identity before we act, to protect your information.

11. Marketing

We only send marketing if you tick the marketing box. Every marketing email has an unsubscribe link, and you can also reply STOP to texts or email us. Service messages about your enquiry or claims are not marketing and will still be sent while we're working for you.

12. Complaints

If you're unhappy with how we've used your data, please tell us first at privacy@familyrefund.com. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

13. Changes to this policy

We may update this policy. The version and date are shown at the top, and we record which version was shown when you gave us your details. If we make a significant change that affects you, we'll tell you by email before it takes effect.