Trader Support Service (TSS) Privacy Notice 

The purpose of this document 

HMRC are committed to protecting the privacy and security of your personal data. This Privacy Notice describes how information is collected and how your personal data is used in accordance with applicable data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA) as part of the Trader Support Service (TSS) process. 

It is important that you read this notice, so that you are aware of how and why we are using your personal data, as a user of the Trader Support Service. 

HMRC is a statutory body with statutory functions and a statutory duty of confidentiality, as set out in the Commissioners for Revenue and Customs Act 2005. We will only share your personal data with third parties, including third-party service providers, where legally permissible. 

You should also read the main HMRC privacy notice alongside this service-specific notice. 

Data protection principles 

We process your personal data in compliance with applicable data protection law, which states that any personal data we hold about you must be: 

  • used lawfully, fairly and in a transparent way. 
  • collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes; 
  • adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; 
  • accurate and kept up to date; 
  • kept in a form that identifies you for only as long as necessary for the purposes we have told you about; 
  • kept securely. 

Our lawful basis for processing your personal data 

We process your personal data on the following lawful basis, in accordance with UK GDPR: Public Task. 

Why we process your personal data 

We process your personal data for TSS to perform HMRC’s functions as a government department. Below we have listed the most relevant purposes for the processing of your personal data and the activities we use it for: 

Business operations: 

We process your personal data for TSS when operating and managing the IT and communications systems, as well as processing of customs declarations and corresponding duty payments. 

The kind of information we hold about you 

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). 

As part of the Trader Support Service, we process various data, including, but not limited to, business details, contact details (including names, phone numbers, and email addresses), data to support declaration submissions and payment transactions e.g. EORI number, authorisations, DDA (Duty  Deferment Account), account details, and guarantee data, which may include your personal data. 

How we collect your personal data 

We collect all data, including your personal data, directly from you (whether an individual or business) through the TSS portal or via other forms of communication, such as by telephone or email, in connection with the Trader Support Service. 

We use cookies and related technologies to improve your browsing experience, analyse individualised usage and website traffic, tailor content to your preferences, and make your interactions with the Trader Support Service website more meaningful. 

How we use your personal data 

We use all data, including your personal data, to provide the Trader Support Service, which may include customs intermediary services and advisory/educational services, to you. We also use all data to improve the Trader Support Service and support ongoing service delivery. 

Change of purpose 

Information processed for the purpose of operating TSS may also be processed in connection with HMRC's other functions, using its powers set out in the Commissioners for Revenue and Customs Act 2005. 

If we intend to process your personal data for another purpose that we reasonably consider to be compatible with the original purpose, we will notify you and explain the legal basis which allows us to do so. 

Who we share your personal data with 

We, in some circumstances and where legally permissible, share your personal data with third parties, for example, if it is necessary for the performance of HMRC functions as a government department or a function of the Crown, another government department or another public authority. 

We may share your personal data with the police and other law enforcement agencies where it is necessary to do so for the prevention, investigation, detection or prosecution of criminal offences. 

Use of third-party service providers 

We share your personal data with third-party service providers who are responsible for the delivery of the Trader Support Service. At all times, HMRC remain as the data controller in respect of your personal data, whereas third-party service providers process your personal data (as a data processor or sub-processor) on behalf of HMRC and in accordance with its instructions.  

The third-party service providers responsible for the delivery of the Trader Support Service include:  

  • Netcompany UK Limited; 
  • Hinduja Global Solutions UK Limited; 
  • Derry Bros Customs Clearance Limited; 
  • The Chartered Institute of Export and International Trade; 
  • Access Paysuite Limited. 
  • Third-party service providers deliver the functionalities of the Trader Support Service platform, including platform delivery, platform maintenance, technical support, payments, security services complex customs support, and production and distribution of educational material to assist with declaration completion. 

How long we retain your personal data 

We will store and retain your personal data until you tell us you no longer require the services you requested, or after 2 years of non-engagement with us. 

Your data protection rights 

You have certain data protection rights in relation to the processing of your personal data, which are outlined below. You can find more about your data protection rights in section 8 of the HMRC Privacy Notice. 

By law, you have the right to: 

  • request access to copies of your personal data and details about the processing of your personal data  – subject access requests in connection with the Trader Support Service should normally be made to HMRC, by following HMRC’s subject access request guidance at https://www.gov.uk/guidance/hmrc-subject-access-request; 
  • request correction of the personal data that we hold about you - this enables you to have any incomplete or inaccurate information we hold about you corrected; 
  • request erasure of your personal data - this enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. This does not apply where we are legally obliged to process your personal data or where the processing is necessary for performing our functions. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing; 
  • object to the processing of your personal data where you have grounds to object which relate to your particular situation, in which case we will stop processing the personal data unless we can demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms; 
  • request the restriction of processing of your personal data - this enables you to ask us to suspend the processing of personal data about you, for example, if you want to establish its accuracy or the reason for processing it; 

We do not have to comply with your requests to the extent that they are likely to prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty or an imposition of a similar nature. 

We can also restrict those rights when we are conducting a criminal investigation, and it is a necessary and proportionate measure to avoid obstructing an official or legal inquiry, investigation or procedure, or avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties. 

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we are allowed under the law to charge a reasonable fee if your access request is manifestly unfounded or excessive. 

Alternatively, we can refuse to comply with the request in such circumstances. 

What we need from you 

As part of the Trader Support Service, we may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). 

This is to ensure that your personal data is not disclosed to any other person who has no right to receive it. 

How and when we will respond to a request 

We will act upon a request without undue delay and at the latest within one month of receipt. We may extend the time to respond by a further 2 months if the request is complex or we have received a number of requests from the same person. 

However, in those circumstances, we will let you know without undue delay and within one month of receiving your request and explain why the extension is necessary. 

Requests to make a subject access request, should normally be made to HMRC, by following HMRC’s subject access request guidance at https://www.gov.uk/guidance/hmrc-subject-access-request. 

If you wish to exercise your other data protection rights in connection with the Trader Support Service, you should contact HMRC’s Data Protection Officer.  

How to contact HMRC or make a complaint 

If you have questions and concerns about how your data is handled, you can contact the Data Protection Officer or make a complaint to HMRC.  For details of how to do this refer to the relevant section of the HMRC privacy notice. 

If your concern remains unresolved by us, you have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk/make-a-complaint). 

Changes to this privacy notice 

We keep our privacy notices under regular review. If we make changes to this notice, we’ll amend the ‘last updated date at the bottom of this page. 

Last updated 9 July 2026.