Privacy policy
How we collect, use, store and protect your information and your child's, including health information, which is special category data under UK GDPR.
Who we are
DLAexpert is run by Karol Slusarczyk, trading as Benefits Expert, a self-employed sole trader registered with HMRC in the United Kingdom. As a sole trader, Karol Slusarczyk is the data controller for the purposes of UK GDPR.
Business address: Redditch, United Kingdom. Contact: support@benefitsexpert.co.uk.
We are registered with the UK Information Commissioner's Office (ICO) under the Data Protection (Charges and Information) Regulations 2018. Our ICO registration number is ICO:00014179042.
What we collect
When you use our report generator, you enter details about your child: their first name, age, health conditions, how the conditions affect them by day and at night, their school or nursery, the professionals involved, the evidence you have and, if you are challenging a decision, what the decision said. If you buy a report, Stripe collects your email address and payment details so we can deliver it.
The free preview needs your email address, because we send your free answer there and keep the free answer to one per person. Our free PDFs (the care diary, the school statement and the evidence tracker) also ask for your email address, so we can send you the link and occasional DLA guidance. The rate checker and the mandatory reconsideration letter generator work without an email address and send nothing unless you ask us to email you the result or the letter.
If you ask us to email your rate check result, we receive only your answers to its questions (your child's age and the options you chose) and work out the result again on our server. If you ask us to email your mandatory reconsideration letter, we receive the details you typed into the letter so we can rebuild it and send it to you. We use them only to send that email: they are not stored on our website servers and they are not copied into the notification we receive when someone signs up. Like any email we send, the sent message stays in our Zoho mailbox, and we delete it if you ask.
When someone asks for a free answer or uses one of our free tools, we receive a short notification in our own mailbox with the email address, the first name and, for the free answer, the condition and the area of the form they chose (no other health details). We use it to follow up and to spot misuse of the free answer, and we delete it if you ask.
When you send a form, our website also records limited technical context: the page you were on, the website that sent you to us and any campaign tags in the web address. This helps us understand which pages are useful. We do not use browser fingerprinting or cross-site tracking.
Health information (special category data)
The health information you give us about your child is special category personal data under Article 9 of UK GDPR. We process it under Article 9(2)(a), explicit consent, which you give by ticking the consent box before we write your free answer or your report, before we email your rate check result or your letter, or before you send us a message through our contact form. As the parent or carer making the claim, you give that consent for your child's information. Please only share information you are entitled to share.
You can withdraw consent at any time by emailing support@benefitsexpert.co.uk. Withdrawal does not affect processing already carried out.
How we use it
Your details are sent over an encrypted connection to our generation system and used only to write your child's answers and guidance. They are not kept on our servers after the report is written, and we share them only with the processors listed below.
Emails from us (opt-in)
If you give us your email address in the free preview or one of our free tools, we may send you occasional emails with DLA form tips, evidence checklists and news about our paid products. We process your email address under Article 6(1)(a) of UK GDPR, consent, which you give by entering it next to the notice that explains what you will receive.
We never share, sell or rent your email address. You can unsubscribe at any time by replying "unsubscribe" to any email from us, or by emailing support@benefitsexpert.co.uk. If you have not opened or clicked any of our emails for 24 months, we remove your address from our lists.
Processors we use
- Stripe (payments): handles card payments. We never see your card details.
- Report generation processor: a text generation service that writes the wording of your answers and guidance. Under its commercial terms your inputs are not used for training, are kept by the provider only for a strictly limited period and are handled under a data processing agreement that requires confidential handling, prohibits any further use and includes the safeguards UK GDPR requires for transfers outside the UK. Questions about this are welcome at support@benefitsexpert.co.uk.
- Zoho Mail (email): sends your report and free emails and stores support correspondence.
- Zoho Campaigns (email lists): holds the email addresses you choose to give us and sends our occasional DLA tips.
- Vercel (hosting): serves the website and keeps short-term request logs (typically 30 days).
- Upstash (database, through Vercel): holds the coded forms and counts used to keep the free answer to one per person, for 30 days at most.
- Google Analytics (optional, only with cookie consent): usage statistics.
- Microsoft Advertising (optional, only with cookie consent): advertising performance.
What we do not do
We do not sell your data or your child's. We do not share it with anyone for marketing. We do not use the health information you enter for anything other than writing your answers and guidance and supporting you afterwards.
Cookies
Essential storage keeps the site working (for example your cookie choice and a saved draft of the form in your own browser). One essential cookie, dla_fd, is set when you get your free answer: a random code with no personal details in it, signed so that it cannot be altered, which lets us limit how many free answers one browser can get. It is sent only to our own servers, cannot be read by the page and expires after 30 days. If you choose "Accept all" on the cookie banner, Google Analytics and Microsoft Advertising load. They never load without your consent. You can change or withdraw your choice at any time with Cookie settings at the bottom of every page. If you choose "Essential only", Google Analytics and Microsoft Advertising stop and the cookies they set on this site are removed.
How long we keep information
What you enter about your child is not kept on our application servers after the report is written. A copy of your report is saved in your own browser for 24 hours so you can come back to it, and you can clear it at any time by clearing this site's data.
To keep the free answer to one per person and to spot repeat sign-ups, we keep coded forms (keyed hashes, which cannot be read back) of your email address and the area you chose, of your internet connection's IP address, of the random code in your browser's free answer cookie, of your email address's domain (the part after the @ sign) and, if you list several conditions, of that list and of each condition in it (each coded on its own), with the time of your free answer and a count. Nothing else you entered is kept with them, and they are deleted automatically after 30 days at most.
Reports are sent only to your email address. We do not copy ourselves in or keep a copy on our side, apart from the sent message in our Zoho mailbox, which we delete if you ask.
Stripe keeps payment records for 7 years for UK financial rules. Vercel request logs are typically kept for 30 days and contain no report content. Support emails stay in our Zoho mailbox until you ask us to delete them. Email addresses you choose to give us stay on our lists until you unsubscribe, or for at most 24 months from your last interaction with our emails.
Your rights
Under UK GDPR you have the right to:
- access your personal data (a subject access request)
- have inaccurate data corrected
- have your data erased
- restrict processing
- move your data to another service
- object to processing
- withdraw consent at any time
To use any of these rights, email support@benefitsexpert.co.uk. We reply within one month.
Complaints
If you think we have mishandled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this policy
We may update this policy as the service changes or the rules change. The date at the top shows when it last changed.