Privacy Policy

Who we are

BackTax ("we", "us") helps PAYE workers in Ireland reclaim tax they have overpaid. We are the data controller for the personal information described on this page, which means we decide what is collected and why, and we are responsible for looking after it.

We are an independent agent and are not affiliated with, or endorsed by, the Office of the Revenue Commissioners.

Our business address: 40 Thomas Davis Street, Cork, T23 V253, Ireland.

This policy is governed by the General Data Protection Regulation (EU) 2016/679 and the Irish Data Protection Act 2018.

What we collect

Almost everything we hold is information you give us directly — when you complete the refund check, when you talk to our team on WhatsApp, or when you send us documents. The rest is read from your Revenue record with your permission.

We do not collect information about your health, ethnicity, politics, religion or sexuality. If you claim medical expenses you may tell us an amount you spent — we record the figure only, never a diagnosis or any detail of treatment.

Why we use it

Data protection law requires us to have a lawful basis for every use of your information. Ours are:

• To perform our agreement with you. Assessing whether you are owed a refund, preparing and filing your returns, keeping you updated, and invoicing our fee once you are paid.
• Your consent. Accessing your Revenue account and filing on your behalf happens only on your explicit instruction. You can withdraw that consent at any time, and we will stop — though we cannot reverse a return already filed with Revenue.
• Legal obligation. Irish tax law requires records relating to a return to be kept for six years, and anti-money-laundering and accounting rules apply to the fees we charge.
• Our legitimate interests. Keeping the service secure, preventing fraud, resolving disputes, and keeping accurate business records — balanced against your interests, and never in a way you would find unexpected.

We do not use your information for automated decision-making that produces a legal effect. A person on our team reviews every claim.

Your PPSN and Revenue account

Two pieces of what we hold deserve their own section, because they carry more risk than the rest.

Your PPS number

Revenue identifies your tax record by PPS number, so we cannot make a claim without it. We use it for that purpose only. It is never shared with introducers, never included in reports, and inside our own system it is hidden from staff unless they have been specifically granted access to it.

Your Revenue login

Where you ask us to file for you, we need to sign in to Revenue as you. Those credentials are held securely and encrypted, are used only to prepare and file your return, and every access is logged. They are stored apart from the rest of your record, and are removed once your claim is complete or as soon as you ask us to remove them.

We are in the process of registering with Revenue as a tax agent. Once that is in place we will be able to act through Revenue's own agent link instead of your login, and we will update this policy at that point.

Who we share it with

We never sell your personal information, and we never share it for advertising. It is disclosed only where it is needed to deliver the service:

• The Revenue Commissioners — the returns, credits and figures that make up your claim. This is the whole point of the service.
• Our own team. Staff see only the clients assigned to them by an administrator; other clients are invisible to them entirely. Access to your phone number, your PPS number and your fee is each granted individually and is off by default.
• The person who referred you, if you came through an introducer. They see your name, the stage your claim has reached, the refund and fee figures, and the relevant dates. They do not receive your contact details, your PPS number or your documents.
• Service providers who process data on our instructions — Stripe (card payments and invoicing), WhatsApp and Twilio (messaging), Google (calendar and record-keeping), and Railway (hosting). Each is bound by a data processing agreement and may use your data only as we direct.
• Our professional advisers, such as accountants or solicitors, where genuinely necessary.
• Anyone we are legally required to disclose to — a court order, a Revenue enquiry, or a statutory request.

Some of these providers process data outside the European Economic Area, principally in the United States. Where that happens the transfer is covered by the European Commission's standard contractual clauses or by the provider's certification under the EU-US Data Privacy Framework.

How long we keep it

• Claim and tax records — six years from the end of the tax year the claim relates to. This is the period Irish tax law requires records to be available for. After that they are deleted.
• Revenue login details — removed as soon as the work is done, or immediately on request.
• Bank details are kept only while needed to settle the refund or our fee.
• Enquiries that never become a claim are deleted within twelve months.

If you ask us to erase your data before the six years are up, we will delete everything we are not legally required to retain, and tell you exactly what remains and why.

How we protect it

• Everything travels over an encrypted HTTPS connection.
• Revenue credentials are encrypted where they are stored, kept separately from your main record, and every access is written to an audit log.
• Sensitive details are requested through access-controlled, tokenised pages rather than over chat, so they never sit in a message thread.
• Staff accounts are individually permissioned — access is granted per client and per field, and defaults to nothing.
• Bank details are masked to the last four digits everywhere they are displayed.

No system is perfectly secure, but if a breach ever occurs that is likely to put your rights at risk, we will tell you and notify the Data Protection Commission within 72 hours, as the law requires.

Your rights

Under GDPR you have the right to:

• Access — get a copy of everything we hold about you.
• Rectification — have anything inaccurate corrected.
• Erasure — have your data deleted, subject to the retention rules above.
• Restriction — have us pause using your data while a dispute is resolved.
• Portability — receive your data in a machine-readable format, or have it sent to another provider.
• Objection — object to processing we carry out on the basis of legitimate interests.
• Withdraw consent — at any time, without affecting anything done before you withdrew it.

Email revbacktax@gmail.com and we will respond within one month. Exercising these rights is free, and we will not treat you differently for doing so.

Cookies

We run no analytics, no advertising pixels and no third-party trackers on this website. Nothing here follows you around the internet.

We use one strictly necessary cookie to remember that you have been granted access to the site, and — if you are a member of staff — your browser stores a sign-in token so the admin app keeps you logged in. Both are essential to the service working, so no consent banner is required for them.

Changes to this policy

We will update this page when the way we handle your information changes — most immediately once our agent registration with Revenue comes through. The date at the top always reflects the current version. If a change materially affects you, we will tell you directly rather than relying on you to notice.

Contact and complaints

We would always rather hear from you first and put something right. But you have the right to complain to the Data Protection Commission at any time, without coming to us at all.