Privacy Policy | Cathedral CIS Tax Rebates

Legal

Last updated: 15 August 2026

1. Who we are

Cathedral CIS Tax Rebates ("Cathedral", "we", "us", "our") helps construction workers claim back overpaid tax under the Construction Industry Scheme (CIS).

For the purposes of UK data protection law, the data controller is R. Curtis trading as Cathedral CIS Tax Rebates.

How to contact us about your data:

Email: cathedraltaxrebates@gmail.com
Phone: 07511 201919

This policy explains what personal information we collect, why we collect it, what we do with it and what rights you have. It applies to our website at www.cathedralcis.co.uk and to our tax rebate services.

2. The information we collect

Because we prepare tax claims on your behalf, we necessarily handle detailed financial information.

We collect:

Information that identifies you Full name, date of birth, home address, previous addresses, email address, telephone number, National Insurance number and Unique Taxpayer Reference (UTR).

Information about your work and income Employment and self-employment history, the contractors you have worked for, CIS payment and deduction statements, payslips, P60s and P45s, invoices, and details of the trade you work in.

Information about your expenses Records of tools, materials, travel, mileage, accommodation, protective clothing, subsistence and other allowable costs, including receipts and photographs of receipts.

Financial information Bank account name, sort code and account number, so that your rebate can be paid to you and our fee settled.

Information about your tax affairs Details of any HMRC penalties, fines, notices, enquiries or arrears; previous tax returns and correspondence with HMRC.

Identity verification documents Where we need to confirm who you are, a copy of your passport, driving licence or other identity document.

Correspondence Emails, text and WhatsApp messages, letters, and notes of telephone conversations with you.

Website information See our Cookie Policy for details of the information collected automatically when you visit our website, including your IP address, device and browser type and how you use our pages.

Special category and criminal offence information

We do not routinely collect special category data (such as information about your health). If you tell us something of this nature — for example, a health condition relevant to a penalty appeal — we will only use it where you have given us your explicit consent, or where it is necessary to establish, exercise or defend a legal claim.

Some of the information we hold may amount to criminal offence data under Article 10 of the UK GDPR — for example, records of HMRC penalties issued for deliberate conduct, or reports we are required to make where we suspect money laundering or tax fraud. We process this information where it is necessary to prevent or detect unlawful acts, or to comply with our obligations under anti-money-laundering law, relying on the conditions in Schedule 1 to the Data Protection Act 2018. We maintain an Appropriate Policy Document explaining how we comply, which is available on request.

3. Where we get your information from

Most of the information we hold comes directly from you, by telephone, email, message or through the forms on our website.

We may also receive information about you from:

Someone who refers you to us. We operate a referral scheme. We ask anyone referring a friend, family member or colleague to check first that the person is happy for us to contact them, and we only make contact on that basis.

When we first get in touch we will tell you who gave us your details, and you can ask us to stop contacting you and to delete your information at any time.

HMRC, where we obtain records of your tax position, deductions and any penalties.

Contractors or agencies you have worked for, where CIS statements or payment records are needed to complete your claim.

4. Why we use your information, and our legal basis for doing so

Under UK GDPR we must have a lawful basis for everything we do with your personal information. Below is what we use your information for, and the basis we rely on in each case.

To assess whether you are likely to be owed a rebate. Our basis is taking steps at your request before entering into a contract.
To prepare, calculate, submit and manage your claim. Our basis is performance of our contract with you.
To prepare backdated returns and appeal HMRC penalties on your behalf. Our basis is performance of our contract with you.
To communicate with you, and with HMRC, about your claim. Our basis is performance of our contract with you.
To verify your identity and prevent fraud. Our basis is our legal obligation to carry out these checks, together with our legitimate interests in preventing fraud.
To take payment of our fee from your rebate. Our basis is performance of our contract with you.
To keep records of the work we have done and the advice we have given. Our basis is our legitimate interests in running our business and being able to defend claims, together with our legal obligation to keep certain records.
To contact you where a friend or colleague has referred you. Our basis is your consent, given through the person who referred you and confirmed by us when we first make contact.
To pay referral rewards. Our basis is performance of our contract with the person making the referral, together with our legal obligation to keep tax records.
To send marketing to people who are not yet clients. Our basis is your consent.
To send existing clients marketing about similar services. Our basis is the "soft opt-in" under regulation 22 of the Privacy and Electronic Communications Regulations. Every message includes a way to opt out.
To understand how our website is used. Our basis is your consent. See our [Cookie Policy].
To respond to complaints and legal claims. Our basis is our legal obligation, together with our legitimate interests in defending our position.

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms, and concluded that they are not. You can ask us for details of that assessment, and you have the right to object (see section 9).

Before making marketing calls we screen numbers against the Telephone Preference Service. You can opt out of marketing at any time, at no cost, by replying to any message or contacting us directly.

You do not have to give us your information, but if you do not provide what we need, we will not be able to prepare or submit a claim for you.

5. Who we share your information with

We do not sell your personal information, and we never will. We share it only as set out here.

HMRC, in order to submit your claim, return, appeal or correspondence.

Our service providers, who process data on our behalf under written contracts that require them to keep it secure and use it only on our instructions. These include:

Wix.com Ltd, which hosts our website and provides our contact forms
Google, which provides our website analytics
our email, messaging and cloud storage providers
our accounting and bookkeeping software providers

Your bank or ours, to make payment of your rebate and to collect our fee.

Our professional advisers, including accountants, insurers and solicitors, where necessary.

Law enforcement, regulators or other authorities, where we are required to disclose information by law, including reporting suspicions of money laundering or tax fraud. Where the law prevents us from telling you about such a disclosure, we will not do so.

A buyer, if we ever sell or transfer our business, in which case your information would transfer with it.

6. Sending information outside the UK

Some of our service providers are based outside the United Kingdom, or store data outside it. This includes Wix and Google, which process data in the United States and elsewhere.

Where information is transferred outside the UK, we make sure it is protected by one of the safeguards permitted by UK data protection law: either the country has been assessed by the UK Government as providing an adequate level of protection (which includes transfers to organisations certified under the UK Extension to the EU–US Data Privacy Framework), or the transfer is covered by the ICO's International Data Transfer Agreement, or by the International Data Transfer Addendum to the European Commission's standard contractual clauses.

You can ask us for a copy of the safeguards that apply.

7. How long we keep your information

We keep your information only for as long as we need it.

Claim and tax records: at least five years after the 31 January submission deadline for the tax year concerned, in line with HMRC's record-keeping requirements for the self-employed. In practice we keep these records for six years, so that we can also deal with any later query, appeal or claim.
Identity verification and anti-money-laundering records: five years from the end of our business relationship with you, as required by regulation 40 of the Money Laundering Regulations 2017. We delete these at the end of that period unless we are required to keep them for longer.
Enquiries that do not become claims: twelve months from your last contact with us, unless you ask us to delete them sooner.
Referral records: six years, because they form part of our accounting records.
Marketing consents and opt-outs: for as long as we operate, so that we can honour your preferences.
Website analytics: as set out in our Cookie Policy.

At the end of these periods we securely delete or destroy the information.

8. How we keep your information safe

We take the security of your information seriously, particularly given how sensitive tax and financial records are. Our measures include restricting access to those who need it, using password-protected and encrypted devices and accounts, using reputable providers with appropriate security standards, and securely disposing of paper records.

No method of transmission over the internet is completely secure. If you send us documents by email or messaging app, please be aware that we cannot guarantee the security of that transmission.

If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours and, where the risk is high, tell you directly.

9. Your rights

Under UK data protection law you have the right to:

Be informed about how we use your information — which is the purpose of this policy
Access the personal information we hold about you, and receive a copy of it
Have inaccurate information corrected
Have information erased, where there is no good reason for us to continue holding it
Restrict how we use your information while a concern is being resolved
Portability — receive certain information in a machine-readable format, or have it sent to another organisation
Object to us using your information for our legitimate interests, and to object at any time to direct marketing
Withdraw your consent at any time, where we rely on consent
Not be subject to automated decision-making that has a legal or similarly significant effect on you. We do not make decisions about you by automated means.

To exercise any of these rights, contact us using the details in section 1. We will respond within one month. If your request is complex, or you have made several requests, we may extend that by up to two further months, and we will tell you if so.

Two things can affect that timescale. If we need to confirm your identity before releasing information, the month does not begin until we have what we need. And if we reasonably need you to clarify what information you are looking for, the clock pauses while we wait for your reply. When responding to a request for access, we will carry out a reasonable and proportionate search for your information.

Exercising your rights is free. We may charge a reasonable fee, or refuse, if a request is clearly unfounded or excessive.

Some of these rights are not absolute. For example, we may be unable to delete information we are required by law to keep for tax or anti-money-laundering purposes.

10. Complaints

You have the right to complain to us about how we have handled your personal information. You can do this by contacting us using the details in section 1. We will acknowledge your complaint within 30 days of receiving it, and respond without undue delay.

If you are not satisfied with our response, or you would prefer not to come to us first, you have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 Website: www.ico.org.uk

Complaining to the ICO does not affect any other legal rights or remedies you have.

11. Children

Our services are intended for adults working in the construction industry. We do not knowingly collect information about anyone under 18. If you believe we hold information about a child, please contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. Where the changes are significant, we will tell existing clients directly.