Last updated: 25 April 2026
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have a number of rights over your personal data. This page summarises those rights and how to exercise them.
You have the right to know what personal data we hold and how we process it. See our Privacy Policy for full details.
You can request a copy of all personal data we hold about you. We will respond within 30 days at no charge.
If any personal data we hold about you is inaccurate or incomplete, you can ask us to correct it. Most personal data can be edited directly in the app.
You can request that we delete your personal data. Note that we may need to retain certain records — particularly CIS-related records — for at least 6 years under HMRC tax record-keeping rules.
You can ask us to limit how we process your data, for example while a complaint is being investigated.
You can request your data in a structured, machine-readable format (CSV or JSON) so you can move it to another service.
You can object to processing based on our legitimate interests, including processing for direct marketing.
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. The refund estimator is a calculation tool — it does not make decisions about you.
To exercise any of these rights, email privacy@cistracker.uk with a description of your request. We may need to verify your identity before responding. We respond within 30 days; for complex requests we may extend by a further two months and will tell you if we do.
If you are not satisfied with how we handle your request, you can complain to the UK Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
ico.org.uk