Last updated: 25 September 2026
Data Controller
ESAexpert is operated by Karol Slusarczyk trading as Benefits Expert, a self-employed sole trader registered with HMRC in the United Kingdom. As a sole trader, Karol Slusarczyk is the data controller for the purposes of UK GDPR.
Business address: Redditch, United Kingdom. Contact: support@esaexpert.co.uk.
We are registered with the UK Information Commissioner's Office (ICO) under the Data Protection (Charges and Information) Regulations 2018. Our ICO registration number is ICO:00014179042. You can verify our registration on the ICO public register.
What Data We Collect
When you use our report generator, you enter your name, health conditions and a description of how they affect your ability to work and carry out daily activities. If you purchase a paid plan, we also collect your email address (via Stripe) to deliver your report.
If you choose to provide your email address in our free preview tool or our Mandatory Reconsideration letter generator, we collect that email so we can send you the requested guidance and occasional follow-up ESA and Work Capability Assessment tips. This is entirely optional - the free preview works without an email.
Our WCA dates tool works out your dates in your browser and makes the calendar file on your device, so nothing is sent to us. Only if you ask us to email the dates and tick the consent box do we receive your email address, the dates you entered, the benefit you chose, whether you live in Great Britain or Northern Ireland and your stage of the claim. We use them to send that one email with a calendar file. Your email address then joins our mailing list for a few follow-up emails about your claim; the dates and the benefit are not added to it. A copy of the email stays in our mailbox's sent items.
Our points calculator, eligibility quiz, LCWRA and Support Group checker, decision analyser and Mandatory Reconsideration letter generator work on the page. Only if you ask us to email your result and tick the consent box do we receive your email address and what is needed to write that email: the descriptor codes you picked and the benefit you chose (calculator), your answer codes (quiz), your answer codes, the benefit you chose and your stage of the claim (LCWRA checker), or the analysis or letter shown on the page, with the date of your decision letter if you add it (analyser and letter generator). We use them to send that one email. If you ask for one of our checklists (substantial risk, example answers), we receive only your email address. In every case your email address then joins our mailing list for a few follow-up emails about ESA and Universal Credit claims; nothing you entered is added to it. If the email came from the decision analyser or the letter generator, your address may also join a separate list for people challenging a decision, so the follow-up emails fit that stage. A copy of each email stays in our mailbox's sent items.
Our website also automatically captures limited technical context when you submit a form: the page you were on, the website that referred you to ESAexpert, and any tracking parameters in the URL (such as UTM tags or ad-click identifiers). This helps us understand which content and channels are useful to claimants. No browser fingerprinting, no cross-site tracking.
Special Category Data
The health information you provide is special category personal data under Article 9 of the UK GDPR. We process this data under Article 9(2)(a) - explicit consent, which you give by ticking the consent box before generating your report.
The dates you enter in the WCA dates tool show that you are claiming a health-related benefit, so we treat them the same way: we only email them after you tick a separate consent box (Article 9(2)(a)), and the box is never ticked for you.
The same applies to a result you ask us to email from the points calculator, the eligibility quiz, the LCWRA and Support Group checker, the decision analyser or the Mandatory Reconsideration letter generator: it describes your health, so we only send it after you tick the consent box next to the email field.
You can withdraw consent at any time by emailing support@esaexpert.co.uk. Withdrawal does not affect processing already carried out.
How We Process Your Data
Your data is sent over HTTPS to our generation system and used solely to produce your personalised guidance for the ESA50/UC50 Work Capability Assessment form. Your inputs are not retained or used for any further purpose, and we do not share them with anyone except the processors listed below.
Marketing Communications (Opt-In Only)
If you provided your email address in our free preview tool or our Mandatory Reconsideration letter tool, we may send you occasional emails containing ESA50/WCA form tips, WCA descriptor explanations, evidence checklists and updates about our paid products. We process your email under Article 6(1)(a) of the UK GDPR - consent, which you give by entering your email address into the form (alongside the on-page notice that explains what you will receive).
We never share, sell or rent your email to anyone else. You can unsubscribe at any time by:
- Replying "unsubscribe" to any email we send you, or
- Emailing support@esaexpert.co.uk with "unsubscribe" in the subject line.
If you have not interacted with any of our emails for 24 months, we will automatically remove your address from our list to avoid emailing inactive contacts.
Third-Party Processors
- Stripe (payment) - handles card payments; we never see card details.
- Report generation processor - your personalised guidance text is generated using Anthropic's commercial API. Under its commercial terms your inputs are not used to train AI models, are retained by the provider only for a strictly limited period, and are handled under a data processing agreement that requires confidential handling, prohibits any further use, and incorporates the safeguards UK GDPR requires for transfers outside the UK. Questions about this arrangement are welcome at support@esaexpert.co.uk.
- Zoho Mail (email) - delivers your report and stores support correspondence.
- Vercel (hosting) - serves the website and keeps short-term request logs (typically 30 days).
- Google Analytics & Google Ads (optional, only with cookie consent) - usage statistics and advertising performance.
- Microsoft Advertising (optional, only with cookie consent) - advertising performance.
What We Don't Do
We do not sell your data. We do not share it with third parties for marketing. We do not use the health information you enter into the generator for any purpose other than producing your guidance and supporting you afterwards. Email addresses you opt in to give us are used only by ESAexpert to send you ESA-related guidance and product updates - never passed to anyone else.
Cookies
Essential cookies keep the site working. If you choose "Accept all" on the cookie banner, Google Analytics, Google Ads and Microsoft Advertising load. Analytics tags never load without your explicit consent. Change your preference by clearing this site's local storage.
Data Retention
Your input (conditions, description) is not retained on our application servers after the report is generated.
Generated reports are sent only to your email address - we do not BCC, archive or otherwise keep a copy on our side.
Stripe retains payment records for 7 years for UK financial regulations. Vercel request logs are typically kept for 30 days and contain no report content. Support emails you send us remain in our Zoho mailbox until you ask us to delete them.
Email addresses you opt in to give us (via free preview, WCA dates tool or the email option on our other free tools) are kept in our Zoho mail folders until you unsubscribe, or for a maximum of 24 months from your last interaction with our emails, whichever comes first.
Your Rights Under UK GDPR
You have the right to:
- Access your personal data (Subject Access Request)
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict processing
- Port your data to another service
- Object to processing
- Withdraw consent at any time
To exercise any of these rights, email support@esaexpert.co.uk. We will respond within one month.
Complaints
If you believe we have mishandled your data, you can complain to the Information Commissioner's Office (ICO):
Changes to This Policy
We may update this policy as the service evolves or as regulations change. Significant changes will be communicated by email to active users and announced on the homepage.