Privacy Policy

1. Who We Are

This Privacy Policy is issued by PSMITH MANAGEMENT CONSULTING ME - FZCO, a company established in the United Arab Emirates (IFZA licence 74519), trading as "The Import Recovery Group" ("IRG", "we", "us", "our"). Our registered office is IFZA Properties, Dubai Digital Park, Dubai Silicon Oasis, Dubai 342001, UAE.

As we are established outside the United Kingdom, we maintain a UK address for correspondence and the service of documents: The Import Recovery Group, U2 Newburn Estate, Shelley Road, Newcastle upon Tyne, NE15 9RT.

For the personal data described in this policy, IRG is the controller, meaning we decide how and why your personal data is processed. We are not acting as a processor on anyone else's behalf.

You can contact us about privacy or data protection at [email protected].

Our UK representative (Article 27 UK GDPR): James Pearson, 44 Wooler Avenue, North Shields, NE29 7BD, United Kingdom; email [email protected]. Individuals and the Information Commissioner's Office (ICO) can contact him on any data protection matter (see section 11).

2. What We Do

IRG helps UK businesses identify and recover overpaid customs duty. We do not claim import VAT back from HMRC: where import VAT looks wrong, we flag it to you so that you can correct it on your own VAT return. To do this, we review customs declarations and related documents submitted to His Majesty's Revenue & Customs ("HMRC"), such as C88 entries, C79 VAT certificates, Movement Reference Numbers (MRNs) and HMRC correspondence, and prepare repayment claims for you. Depending on the claim, it is submitted to HMRC by you or by a specialist import or customs adviser we use (clause 1 of our Terms).

We also operate a website with an online assessment tool that lets businesses check whether they may have a claim, and we carry out outbound business-to-business prospecting to reach importers who may benefit from our service.

3. The Personal Data We Collect

Depending on how you interact with us, we may collect the following:

1. Assessment and enquiry data. When you use our online assessment or contact us, we collect your name, business email address, phone number, company name, and the answers you give about your import activity (for example, goods imported, volumes, suppliers and duty paid).
2. Client and engagement data. If you engage us, we collect information about your business and the individuals authorised to act for it, including contact and role details, and the details recorded in your Letter of Authority. Where you sign electronically, we retain the associated audit record (timestamp, IP address and signing metadata) as evidence of execution.
3. Customs and claim data. To carry out our service, we process your import declaration records and supporting customs documentation (such as C88 entries, C79 certificates, MRNs and invoices) and correspondence between you, us and HMRC relating to your claims. This documentation may incidentally contain personal data of your staff or contacts.
4. Prospecting data. For outbound business development, we collect business contact information (such as a company name, business address, a named contact and business email or phone number) from public sources and third-party business-data providers.
5. Website and usage data. When you use our website, we collect technical information such as your IP address, device and browser type, pages viewed and the cookies described in section 10.
6. Visits from our emails. The links in our business emails include a reference so that we know which business visited our website from our email, and which of our pages they looked at (for example, whether they opened the assessment or booked a call). The reference identifies the email we sent, and so the person we sent it to. It travels in the web address itself: our server records the page request when it arrives, and the links on those pages carry the same reference so the next page in that visit is linked too. Nothing is stored on or read from your device for this: no cookies, no browser storage, no tracking script and no third-party analytics. Automated email-security systems open links too, so opening a link is recorded but never, on its own, treated as a visit by you. We only treat it as interest from you when you click a button on our page (for example, to view your Duty Snapshot or book a call), book a call, answer our assessment or reply to our email. We use this only to decide when and how to follow up (by email or by phone) and what to send next; we never change our fees or terms because of it. To spot when an email has been passed on to a colleague, we keep a code made with a secret key from the day, the general network your device was on (part of its IP address) and your type of browser: it is a keyed one-way code that changes every day, reveals at most the general network your device was on, and is never stored alongside your IP address, which we do not keep for this purpose. If you forward our email, visits through those links are linked to the email we sent you; we treat such a visit as interest from your business, not as your personal activity.

Call recording. We may record and transcribe our business phone calls for training and quality. We rely on our legitimate interests to do this (see section 4). If we want to record a call, we say who we are and then, before anything else, ask whether you are happy for the call to be recorded and transcribed. We only start recording if you agree; if you do not, we do not record the call and we delete any recording that had already started. Recordings are held in our Microsoft 365 account. The transcript text we keep in our own system, and the recordings, are deleted after 90 days. We use our AI provider (Anthropic) to produce summaries of calls from their transcripts; it acts as our processor.

We do not seek to collect special category data (such as health data) and ask that you do not send it to us unless it is strictly necessary for a claim.

4. Our Lawful Bases for Processing

Under the UK GDPR we must have a lawful basis for using your personal data. We rely on the following:

1. Performance of a contract. To deliver the services set out in our Terms and your Letter of Authority: reviewing your declarations, preparing claims and having them submitted to HMRC (by you or by a specialist we use under clause 1 of our Terms), and managing your engagement.
2. Legitimate interests. To operate, administer and protect our business; to respond to enquiries and run our assessment tool; to carry out business-to-business prospecting, including knowing which businesses visit our website from our emails so that we can follow up at the right time with the ones that are interested; to record and transcribe business calls for training and quality; to keep records; and to prevent fraud and misuse. Where we rely on legitimate interests, we balance those interests against your rights, and you can object at any time (see section 8).
3. Marketing. We send business-to-business marketing emails about our services on the basis of our legitimate interests (above). You can object at any time: use the unsubscribe link in any of our emails or reply 'stop', and we will stop.
4. Legal obligation. Where we must process data to comply with a legal or regulatory obligation.

5. How We Use Your Data

We use your personal data to:

1. Provide the online assessment and give you an indicative result;
2. Respond to your enquiries and set up your engagement;
3. Review your declarations and prepare repayment claims for submission to HMRC by you or by a specialist we use;
4. Liaise with HMRC and keep you informed of progress and outcomes;
5. Issue invoices and administer payment of our fees;
6. Maintain our records and manage our relationship with you;
7. Carry out business-to-business prospecting to identify importers who may benefit from our service;
8. Send you marketing about our services (you can object at any time: use the unsubscribe link or reply 'stop'), and comply with our legal obligations.

6. Who We Share Your Data With

We do not sell your personal data. We share it only where necessary to deliver our service, operate our business, or comply with the law, including with:

1. HMRC, to submit and progress repayment claims made for you (by you or by a specialist we use);
2. Specialist import or customs advisers we use under clause 1 of our Terms, where one prepares or submits a claim for you, only as needed for that claim and on a confidential basis;
3. Our hosting provider (Render), which hosts our website, application and databases;
4. Our network and security provider (Cloudflare), which carries traffic to our website and protects it and its forms from automated attacks;
5. Our e-signature provider (DocuSeal), used to issue and record electronic Letters of Authority;
6. Our email sending provider (Resend), used to send transactional and marketing emails;
7. Our office email and productivity provider (Microsoft 365), used for our business mailboxes, calendars and documents;
8. Telegram, the messaging service we use for internal staff alerts, which receives no personal data about you from us (see below);
9. Our AI provider (Anthropic), used to help us read and sort replies to our emails, to summarise our business calls from their transcripts and to assist our staff in their work;
10. Business-data and enrichment providers, from whom we obtain and verify business contact information for prospecting;
11. An adviser who introduced you to us (for example your customs broker), where we pay them a share of our fee: we tell them whether you became a client and the amount recovered, only as needed to work out and pay their share. We tell you who they are and how much they receive before you sign;
12. Professional advisers (such as our legal or accounting advisers) and authorities, where required to establish, exercise or defend legal rights or to comply with the law.

The providers above who process personal data on our behalf act as our processors under written contracts that require them to keep your data secure and use it only on our instructions. Telegram is not one of them because we do not send it your personal data.

Telegram. We use Telegram to send short alerts to our own staff, for example that a business has visited our website from our email, opened its Duty Snapshot, started or completed our assessment, booked a call, replied or unsubscribed. Alerts contain only the company name, the type of event, its time and a link to our own system. They do not include the name, contact details or messages of anyone at your business. Where a business is not a registered company (for example a sole trader, whose business name can be their own name), the alert does not name it. Our staff open our own system to see any details. We use Telegram on its standard terms of service, not under a data processing contract we have agreed with it. Telegram stores these messages on its servers until they are deleted from the chat; we do not currently delete them automatically, so they are kept until we remove them.

Our website's fonts and styles are served from our own servers: your browser does not fetch them from Google Fonts or any other third-party content delivery network.

7. International Transfers

Because IRG is established in the United Arab Emirates, which the UK has not recognised as providing an adequate level of data protection, your personal data will be transferred from the United Kingdom to the UAE, and may be accessed by our team there.

Where we make such a transfer, we put in place an approved safeguard: the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures needed to ensure your data receives a level of protection essentially equivalent to that under UK law. Some of our providers may also process data outside the UK under equivalent safeguards. A copy of the relevant transfer mechanism is available on request from [email protected].

8. Your Rights

Under the UK GDPR you have the following rights in relation to your personal data:

1. Access: to ask for a copy of the personal data we hold about you;
2. Rectification: to have inaccurate or incomplete data corrected;
3. Erasure: to ask us to delete your data in certain circumstances;
4. Restriction: to ask us to limit how we use your data in certain circumstances;
5. Objection: to object to processing based on our legitimate interests, and to object to direct marketing at any time;
6. Portability: to receive certain data in a structured, commonly used, machine-readable format, or have it transferred to another controller;
7. Withdraw consent: where we ever ask for and rely on your consent, to withdraw it at any time.

To exercise any of these rights, email us at [email protected]. We will respond within one month, and will not charge a fee unless your request is manifestly unfounded or excessive. Some rights are qualified and may not apply in every case, for example, we may need to retain certain records to comply with the law or to establish, exercise or defend legal claims.

9. How Long We Keep Your Data

We keep personal data only for as long as we need it for the purposes described in this policy, and then delete or anonymise it. In practice:

1. Assessment and enquiry data that does not lead to an engagement is kept for a limited period so we can follow up, after which it is deleted or anonymised;
2. Client, engagement and claim records are retained for the duration of the engagement and afterwards for as long as needed to meet our legal, tax and regulatory obligations and to establish, exercise or defend legal claims;
3. Prospecting data is reviewed periodically and removed where it is no longer accurate or relevant, or on request.
4. Records of visits from our emails are kept for 6 months and then deleted automatically.
5. Call recordings and transcripts are deleted after 90 days.

Where a specific retention period is fixed by law (for example, tax record-keeping requirements), we apply that period.

10. Cookies

Our website uses only essential cookies: they keep staff and clients signed in to their accounts and protect those sessions, and the site will not work properly without them. Apart from a short-lived security cookie that our network provider, Cloudflare, may set to tell people from automated bots (for example __cf_bm, 30 minutes), they are not set when you simply browse our public pages. Where a form uses Cloudflare's anti-bot check (Turnstile), it runs only to protect that form. These cookies are strictly necessary. We do not use analytics, advertising or tracking cookies. If we introduce analytics or other non-essential cookies in future, we will ask for your consent first and update this policy. You can control or delete cookies through your browser settings.

When you arrive from a link in one of our emails, nothing is stored on your device: the reference described in section 3 is part of the web address, and it is our server that records the visit. You can object to this at any time (see section 8), separately from or together with unsubscribing. Once you unsubscribe or object, links in emails we sent you earlier no longer record visits.

11. Our UK Representative

As we are established outside the United Kingdom, we have appointed a representative in the UK under Article 27 of the UK GDPR. Individuals and the Information Commissioner's Office (ICO) can contact our representative on any data protection matter:

James Pearson, 44 Wooler Avenue, North Shields, NE29 7BD, United Kingdom, [email protected]

You can also raise any data protection matter with us directly at [email protected].

12. Complaints

If you have a concern about how we handle your personal data, please contact us first at [email protected] so we can try to resolve it.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk. We would, however, appreciate the chance to address your concerns before you approach the ICO.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Any new version will be published at importrecoverygroup.co.uk/privacy with a new version number and effective date. Where changes are significant, we will take reasonable steps to bring them to your attention.