Privacy Policy

1. Who We Are

This Privacy Policy is issued by PSmith Management Consulting Me - FZCO, a company established in the United Arab Emirates, trading as "The Import Recovery Group" ("IRG", "we", "us", "our"). Our registered office is IFZA Properties, Dubai Digital Park, Dubai Silicon Oasis, Dubai 342001, UAE.

As we are established outside the United Kingdom, we maintain a UK address for correspondence and the service of documents: The Import Recovery Group, U2 Newburn Estate, Shelley Road, Newcastle upon Tyne, NE15 9RT.

For the personal data described in this policy, IRG is the controller — meaning we decide how and why your personal data is processed. We are not acting as a processor on anyone else's behalf.

You can contact us about privacy or data protection at [email protected].

2. What We Do

IRG helps UK businesses identify and recover overpaid customs duty. We do not claim import VAT back from HMRC: where import VAT looks wrong, we flag it to you so that you can correct it on your own VAT return. To do this, we review customs declarations and related documents submitted to His Majesty's Revenue & Customs ("HMRC"), such as C88 entries, C79 VAT certificates, Movement Reference Numbers (MRNs) and HMRC correspondence, and prepare repayment claims for you, which are submitted to HMRC by you or by a specialist import or customs adviser we use.

We also operate a website with an online assessment tool that lets businesses check whether they may have a claim, and we carry out outbound business-to-business prospecting to reach importers who may benefit from our service.

3. The Personal Data We Collect

Depending on how you interact with us, we may collect the following:

1. Assessment and enquiry data. When you use our online assessment or contact us, we collect your name, business email address, phone number, company name, and the answers you give about your import activity (for example, goods imported, volumes, suppliers and duty paid).
2. Client and engagement data. If you engage us, we collect information about your business and the individuals authorised to act for it, including contact and role details, and the details recorded in your Letter of Authority. Where you sign electronically, we retain the associated audit record (timestamp, IP address and signing metadata) as evidence of execution.
3. Customs and claim data. To carry out our service, we process your import declaration records and supporting customs documentation (such as C88 entries, C79 certificates, MRNs and invoices) and correspondence between you, us and HMRC relating to your claims. This documentation may incidentally contain personal data of your staff or contacts.
4. Prospecting data. For outbound business development, we collect business contact information (such as a company name, business address, a named contact and business email or phone number) from public sources and third-party business-data providers.
5. Website and usage data. When you use our website, we collect technical information such as your IP address, device and browser type, pages viewed and the essential cookies described in section 10.

We do not seek to collect special category data (such as health data) and ask that you do not send it to us unless it is strictly necessary for a claim.

4. Our Lawful Bases for Processing

Under the UK GDPR we must have a lawful basis for using your personal data. We rely on the following:

1. Performance of a contract. To deliver the services set out in our Terms and your Letter of Authority: reviewing your declarations, preparing claims and having them submitted to HMRC (by you or by a specialist we use), and managing your engagement.
2. Legitimate interests. To operate, administer and protect our business; to respond to enquiries and run our assessment tool; to carry out business-to-business prospecting; to keep records; and to prevent fraud and misuse. Where we rely on legitimate interests, we balance those interests against your rights, and you can object at any time (see section 8).
3. Consent. We rely on your consent only for marketing communications. You can withdraw that consent at any time, without affecting anything we did before you withdrew it.
4. Legal obligation. Where we must process data to comply with a legal or regulatory obligation.

5. How We Use Your Data

We use your personal data to:

1. Provide the online assessment and give you an indicative result;
2. Respond to your enquiries and set up your engagement;
3. Review your declarations and prepare repayment claims for submission to HMRC by you or by a specialist we use;
4. Liaise with HMRC and keep you informed of progress and outcomes;
5. Issue invoices and administer payment of our fees;
6. Maintain our records and manage our relationship with you;
7. Carry out business-to-business prospecting to identify importers who may benefit from our service;
8. Send you marketing where you have consented, and comply with our legal obligations.

6. Who We Share Your Data With

We do not sell your personal data. We share it only where necessary to deliver our service, operate our business, or comply with the law, including with:

1. HMRC, to submit and progress the repayment claims made for you (by you or by a specialist we use);
2. Hosting and infrastructure providers who host our website, application and databases on our behalf;
3. Our e-signature provider (DocuSeal), used to issue and record electronic Letters of Authority;
4. Our email provider (Resend), used to send transactional and, where consented, marketing emails;
5. Business-data and enrichment providers, from whom we obtain and verify business contact information for prospecting;
6. Professional advisers (such as our legal or accounting advisers) and authorities, where required to establish, exercise or defend legal rights or to comply with the law.

The providers above who process personal data on our behalf act as our processors under written contracts that require them to keep your data secure and use it only on our instructions.

7. International Transfers

Because IRG is established in the United Arab Emirates — which the UK has not recognised as providing an adequate level of data protection — your personal data will be transferred from the United Kingdom to the UAE, and may be accessed by our team there.

Where we make such a transfer, we put in place an approved safeguard: the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures needed to ensure your data receives a level of protection essentially equivalent to that under UK law. Some of our providers may also process data outside the UK under equivalent safeguards. A copy of the relevant transfer mechanism is available on request from [email protected].

8. Your Rights

Under the UK GDPR you have the following rights in relation to your personal data:

1. Access — to ask for a copy of the personal data we hold about you;
2. Rectification — to have inaccurate or incomplete data corrected;
3. Erasure — to ask us to delete your data in certain circumstances;
4. Restriction — to ask us to limit how we use your data in certain circumstances;
5. Objection — to object to processing based on our legitimate interests, and to object to direct marketing at any time;
6. Portability — to receive certain data in a structured, commonly used, machine-readable format, or have it transferred to another controller;
7. Withdraw consent — where we rely on consent (for marketing), to withdraw it at any time.

To exercise any of these rights, email us at [email protected]. We will respond within one month, and will not charge a fee unless your request is manifestly unfounded or excessive. Some rights are qualified and may not apply in every case — for example, we may need to retain certain records to comply with the law or to establish, exercise or defend legal claims.

9. How Long We Keep Your Data

We keep personal data only for as long as we need it for the purposes described in this policy, and then delete or anonymise it. In practice:

1. Assessment and enquiry data that does not lead to an engagement is kept for a limited period so we can follow up, after which it is deleted or anonymised;
2. Client, engagement and claim records are retained for the duration of the engagement and afterwards for as long as needed to meet our legal, tax and regulatory obligations and to establish, exercise or defend legal claims;
3. Prospecting data is reviewed periodically and removed where it is no longer accurate or relevant, or on request.

Where a specific retention period is fixed by law (for example, tax record-keeping requirements), we apply that period.

10. Cookies

Our website uses a small number of cookies. These are essential cookies that keep you signed in and maintain your session and security while you use the site; the site will not function properly without them. If we introduce analytics or other non-essential cookies in future, we will ask for your consent first and update this policy. You can control or delete cookies through your browser settings.

11. Our UK Representative

As we are established outside the United Kingdom, we are required to appoint a representative in the UK under Article 27 of the UK GDPR. You may contact our UK representative on data protection matters:

[UK GDPR Representative — to be appointed]

Until our representative is confirmed, you can raise any data protection matter with us directly at [email protected] or at our UK correspondence address in section 1.

12. Complaints

If you have a concern about how we handle your personal data, please contact us first at [email protected] so we can try to resolve it.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk. We would, however, appreciate the chance to address your concerns before you approach the ICO.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Any new version will be published at importrecoverygroup.co.uk/privacy with a new version number and effective date. Where changes are significant, we will take reasonable steps to bring them to your attention.