Privacy Policy
Potly Pension Relief
Last updated: 14 July 2026
This Privacy Policy explains how Potly Ltd (trading as Potly Pension Relief) collects, uses, stores and protects your personal data when you use our website and service, and sets out your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We take privacy seriously. Because our service involves genuinely sensitive information — including your National Insurance number, Unique Taxpayer Reference and pension details — we have designed our processes to collect only what we need, hold it only as long as we need it, and restrict who can access it. This policy explains exactly how.
1. Who we are and how to contact us
The best way to reach us is by email at contact@potlypensionrelief.co.uk. This is our primary contact route for any question about this policy, about your data, or to exercise your rights.
Our formal and legal details:
Data controller: Potly Ltd (trading as Potly Pension Relief)
Company registered in England & Wales, company number 16635593
Registered office: 167–169 Great Portland Street, Fifth Floor, London, W1W 5PF
Information Commissioner's Office (ICO) registration number: ZC096123
For the purposes of the UK GDPR, Potly Ltd is the data controller — the organisation that decides how and why your personal data is processed. Your contract for the service is with Potly Ltd.
2. What our service does (and does not do)
We help UK higher-rate and additional-rate taxpayers identify and prepare a claim for unclaimed pension tax relief from HMRC. You pay a one-off fee, complete a calculator and a form, and we prepare a claim pack — a cover letter, an evidence checklist and a Pension Tax Relief & Allowance Report — which you then submit to HMRC yourself.
To be clear about the limits of our role:
We are not a tax agent and are not registered as your agent with HMRC.
We do not submit claims to HMRC on your behalf — you sign and submit your own claim.
We do not provide financial or tax advice.
We do not handle any tax refunds — HMRC pays you directly.
This matters for your privacy because it means we do not act on your behalf with HMRC and do not receive your refund. We prepare documents; you remain in control of your own claim.
3. Our privacy-friendly calculator design
Our free calculator runs entirely in your web browser. The figures you enter to see an estimate are processed on your own device and are not transmitted to us while you are using the calculator.
Your information only reaches our systems when you actively choose to proceed by clicking “Get claim pack” and begin a purchase. Until that point, we do not receive or store the details you type into the calculator. This is a deliberate data-minimisation choice: you stay in control of your information until you decide to buy.
4. The personal data we collect
Once you proceed past the calculator, we collect the following, depending on the stage:
At checkout (via Stripe)
Name (as entered at Stripe checkout)
Email address
Billing address
Payment card details are handled entirely by Stripe. We never see or store your card number.
In the claim form (after payment)
Full legal name (as held by HMRC)
Email address and, optionally, phone number
Home address (address lines, town, county, postcode)
National Insurance number
Unique Taxpayer Reference (UTR), if you are registered for Self Assessment
Employer payroll reference (optional)
Pension provider names, scheme types and policy references
Pension contribution amounts per provider, per tax year
Tax years being claimed for, income figures and benefits in kind
Tax region (rest of UK or Scotland) and scheme membership history
Whether you are registered for Self Assessment, and your preferred refund method
Automatically
Basic usage data such as IP address, browser type and pages visited, via essential and (with your consent) analytics cookies — see section 9.
A magic-link token — a random identifier we generate after payment and send to you by email so you can return to your pre-filled form. It identifies your session and record, and is treated as personal data.
5. How we treat your sensitive information
Your National Insurance number, UTR and pension data are not “special category” data under the UK GDPR, but they are highly sensitive personal identifiers and financial data. We recognise that, taken together, this is a genuinely sensitive dataset, and we handle it accordingly:
Data is encrypted in transit between the services that process it.
Access is restricted to Potly personnel only. Our founder reviews each claim pack; no external party has standing access to your data.
We hold this data for the shortest period we reasonably can — see the retention schedule in section 7.
We do not use your sensitive data for marketing, profiling or any purpose beyond preparing your claim pack.
This matters for your privacy because it means we do not act on your behalf with HMRC and do not receive your refund. We prepare documents; you remain in control of your own claim.
6. Our lawful basis for processing
Under the UK GDPR we must have a lawful basis for processing your personal data. Our bases are as follows:
Calculator stage: no processing of your personal data by us, because the calculator runs in your browser and your inputs are not sent to us.
From “Get claim pack” onwards (checkout and form): performance of a contract (Article 6(1)(b)). Processing your details, including your National Insurance number, UTR and pension data, is necessary to provide the claim pack you have purchased.
Payment and transaction records: compliance with a legal obligation (Article 6(1)(c)) — we must keep certain financial records for tax and accounting purposes.
Analytics cookies: consent (Article 6(1)(a)), which you give or decline via our cookie banner and can withdraw at any time.
If you do not provide the information needed for your claim pack, we will not be able to prepare it and cannot provide the service.
7. How long we keep your data
We do not hold your sensitive tax data any longer than we need to. Once we have delivered your claim pack, it is your responsibility to keep your copies and share them with HMRC as needed. Our retention periods are:
The reason for the split above is deliberate. HMRC can take several months to process a claim, so a refund question may arise long after your documents have been deleted. Keeping a de-identified calculation record for 18 months means we can check whether a rejection was caused by an error on our side — without holding onto your National Insurance number, UTR or address, which play no part in that check and are deleted at 90 days.
Marketing data: not applicable — we do not send marketing emails.
Google Analytics is provided by Google. You can read how Google handles this data at policies.google.com/privacy, and you can opt out across all websites using Google's browser opt-out add-on.
8. Who we share your data with
We do not sell your data, and we do not share it with anyone outside the operational needs of delivering your claim pack. Your data is processed by the following service providers (data processors) acting on our instructions:
Within Potly, only authorised Potly personnel access your data, for the purpose of preparing and reviewing your claim pack. No external developer or agency has standing administrative access to the systems holding your personal data.
We may also disclose your data where we are required to do so by law, or in response to a valid request from a public authority such as a court, HMRC or a regulator.
9. International transfers
Some of our processors are based outside the UK. Where your personal data is transferred outside the UK, we make sure an appropriate safeguard recognised under the UK GDPR is in place. The specific mechanism for each processor is shown in the table in section 8. In summary:
Stripe (US) and Google (US): we rely on the UK Data Bridge, as both are certified under the Data Privacy Framework and its UK extension.
Make.com (EU): data stays within the European Economic Area, which the UK recognises as providing adequate protection.
Railway (US): we rely on Standard Contractual Clauses together with the UK Addendum, as set out in Railway's Data Processing Addendum.
You can ask us for more information about these safeguards, including copies of the relevant contractual protections (redacted where necessary), using the contact details in section 1.
10. Cookies
Our website uses a small number of cookies and similar technologies:
Essential cookies: required for the website, the form and payment to function. These do not require consent.
Analytics cookies (e.g. Google Analytics): used to understand how visitors use our site. These are only set with your consent, which you give or decline through our cookie banner and can withdraw at any time.
Railway (US): we rely on Standard Contractual Clauses together with the UK Addendum, as set out in Railway's Data Processing Addendum.
The magic-link token described in section 4 is delivered by email as part of a web address; it is not a cookie, but we mention it here for completeness because it identifies your session.
You can control or delete cookies through your browser settings. Blocking essential cookies may stop parts of the service from working.
11. Your rights
Under the UK GDPR you have the right to:
Access the personal data we hold about you and receive a copy of it.
Have inaccurate or incomplete data corrected.
Have your data erased where there is no lawful reason for us to keep it.
Restrict or object to our processing in certain circumstances.
Data portability — receive certain data in a structured, machine-readable format.
Withdraw consent (for example, to analytics cookies) at any time, without affecting processing carried out before withdrawal.
To exercise any of these rights, email us at contact@potlypensionrelief.co.uk. We may ask you to verify your identity first. We aim to respond within one month, and will tell you if we need longer, as allowed by law. There is no charge for making a request in most cases.
If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk. We would, however, appreciate the chance to resolve your concern first.
12. Security
We take reasonable technical and organisational measures to protect your personal data, including encryption in transit, restricted access, and use of reputable service providers. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly if a problem arises.
13. Children
Our service is intended for adult taxpayers. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Children
Our service is intended for adult taxpayers. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time — for example, if we change a service provider or add a new feature. When we do, we will update the “Last updated” date at the top and, where the change is significant, bring it to your attention. Please check this page from time to time.
Questions about this policy? Email contact@potlypensionrelief.co.uk.
