Privacy & Data Protection Policy for CSA Calculator

1. Data Controller Information

Under the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), the data controller responsible for personal information processed through this website is:

This policy governs all pages on csacalculator.net, including the flagship CMS 2012 assessment workspace, all 44 specialized regional and financial calculators, the statutory knowledge hub, and our advisory contact desk.

2. How the CSA Calculator Tool Processes Your Data (Client-Side Architecture)

The defining architectural principle of the CSA Calculator tool is that computational logic is executed strictly on the client side (Article 25 UK GDPR - Data Protection by Design and by Default).

When you enter financial parameters into any of our assessment workspaces:

• Local Memory Calculation: Your gross income (Reg 34–36), pension relief deductions (Reg 37), resident child percentages (Reg 44), rate band classifications, qualifying child multipliers, and shared care overnight reductions (Reg 46) are processed exclusively by JavaScript running in your web browser's local RAM.
• No Cloud Transmission: None of the numeric figures, salary amounts, pension contributions, overnight counts, or child totals you type into the inputs are transmitted via HTTP POST or WebSocket to our servers, Cloudflare edge workers, or any third-party analytics provider.
• Ephemeral Session Lifecycle: The calculation exists only in your browser tab. The instant you close the window, navigate away, or hit refresh, all variables are immediately discarded from volatile browser memory. No calculation history is written to a server database or server log.

3. Categories of Information: What We Refuse to Collect

3.1 Confidential Calculation Inputs (NEVER Collected or Logged)

To maintain absolute confidentiality for separating families, CSA Calculator categorically refuses to collect, log, or harvest:

3.2 Information You Voluntarily Submit to Our Advisory Desk

The only time personal information enters our systems is when you voluntarily contact our advisory or engineering desk via our Contact Us page or by direct email:

• Your name and contact email address
• Your professional background or role (e.g. paying parent, receiving parent, solicitor, mediator)
• The specific tool, statutory gateway, or scenario question you describe in your message

Lawful Basis: Article 6(1)(f) UK GDPR (Legitimate Interests) in addressing user support inquiries and maintaining statutory calculation accuracy, and Article 6(1)(b) where inquiries relate to legal professional partnerships.

3.3 Ephemeral Technical Connection Data

To deliver web pages securely, prevent distributed denial-of-service (DDoS) attacks, and maintain server reliability, our edge hosting infrastructure (Cloudflare) automatically processes standard HTTP request headers:

• Browser user-agent, operating system, and language header
• Truncated/anonymized IP addresses (processed for edge routing and DDoS threat detection)
• Timestamp, protocol version, and requested URL route

These network logs are strictly separated from tool usage, contain zero calculation inputs, and are purged on a rolling 30-day schedule.

4. Cookies and Client-Side LocalStorage Policies

In accordance with the Privacy and Electronic Communications Regulations (PECR):

• No Third-Party Advertising Cookies: We do not deploy third-party advertising cookies, retargeting pixels (e.g. Meta Pixel, TikTok, LinkedIn), or cross-site tracking scripts.
• Functional LocalStorage: We may utilize benign, client-side browser LocalStorage solely to remember functional user preferences—such as your preferred currency display (e.g. GBP, EUR, USD) or language selection across page reloads. This data stays 100% on your device and is never shared.
• Privacy-Conscious Analytics: Any aggregated performance measurement deployed uses cookieless, privacy-first telemetry that does not track individual user identities across the web.

5. Privacy in Direct Pay Agreements vs. Official CMS Enforcement

A major driver behind why separated parents choose CSA Calculator is confidentiality. When families open a formal government case under the CMS Collect & Pay scheme:

• The government accesses historic HMRC employer records and contacts payroll departments to issue Deduction from Earnings Orders (DEO).
• Personal financial details are shared through formal correspondence, escalating tension between parents.
• The state extracts a 20% surcharge from the paying parent and deducts 4% from the child's maintenance.

By using CSA Calculator in total privacy, parents obtain an objective statutory assessment without government surveillance. Parents can review the figures privately, confirm mutual agreement, and set up a confidential Direct Pay bank standing order—keeping both their financial records private and their money in the family.

6. Third-Party Infrastructure & Immunity from Disclosure Requests

We do not sell, rent, or transfer personal data to any commercial third parties. The only service providers involved in platform delivery are:

• Cloud Edge Delivery: Cloudflare, Inc. provides CDN caching, SSL encryption, and DDoS mitigation under UK-approved Standard Contractual Clauses (SCCs).
• Government & Family Court Inquiries: We are entirely independent of the Department for Work and Pensions (DWP), the CMS, and HMCTS. If a former partner, solicitor, or government agency requests records of your calculations, we cannot produce them. Our client-side architecture means your calculation was never stored on our infrastructure.

7. Data Retention & Disposal Schedule

8. Technical and Organisational Security Measures

In compliance with Article 32 UK GDPR, we implement rigorous technical safeguards:

• Universal TLS 1.3 encryption across all platform endpoints
• Strict Content Security Policy (CSP) and HTTP Strict Transport Security (HSTS) headers
• Zero backend database exposure for calculator modules
• Multi-factor authentication (MFA) and least-privilege access for support email accounts

9. Protection of Children's Data

While CSA Calculator determines statutory maintenance for the benefit of qualifying children, the platform is designed strictly for use by adults aged 18 and older. We do not knowingly collect, request, or store personal information relating to minors in compliance with the UK Age Appropriate Design Code.

10. Your Statutory Rights under UK GDPR

Under Chapter III of the UK GDPR and the Data Protection Act 2018, you possess full statutory rights:

To exercise any statutory right, contact our Data Protection Desk at privacy@csacalculator.net. We respond to verified statutory requests within one calendar month free of charge.

11. Complaints to the Information Commissioner's Office (ICO)

If you believe our data handling practices violate UK data protection legislation, you have the right to lodge a complaint with the UK supervisory authority:

12. Revisions to this Privacy Policy

We periodically review this policy to reflect new DWP statutory instruments, Family Court case law, or computational enhancements across our 44 tools. Updated versions will be posted on this page with an updated "Last Reviewed" timestamp.