Legal
Privacy notice
What personal data SortaSystems holds, why, how long for, and what you can ask us to do about it.
Who we are
SortaSystems is the data controller for the personal data described here. We design and build websites, set up IT and cloud services, build custom software, automations and AI assistants, and look after them on monthly care plans, for small businesses in the United Kingdom, Europe and the United States.
Our address for formal correspondence is 1 George Williams Way, Colchester, Essex CO1 2JS, United Kingdom. Email hello@sortasystems.com or call +44 1206 355959.
We are a small business and are not required to appoint a data protection officer. Enquiries about this notice go to the email address above and are answered by a person.
What we collect, and why
Each row is a separate purpose with its own legal ground under Article 6 of the UK GDPR.
| Purpose | What we hold | Legal ground | How long |
|---|---|---|---|
| Answering an enquiry you send us | Your name, email address, telephone number, company, what you wrote and the page you sent it from, plus your IP address and country, which we use to keep spam out | Steps taken at your request before a contract, and our legitimate interest in keeping spam out | While there is a realistic prospect of working together, and no more than 3 years from our last contact |
| The chat window on this site | The messages you send, our replies, the time, contact details you choose to give, and technical request identifiers (IP address, browser, and approximate country) for security and rate limiting. If you give your business's website, town or business email, the chat also looks up public information about the business on the web and keeps it with the conversation | Steps taken at your request before a contract, and our legitimate interest in security and in understanding your enquiry | 90 days from your last message, or sooner if you ask |
| Calls to our phone line | Your phone number, a transcript of the call, a summary, and the details you give, such as your name, callback number, company and the reason for your call. If you book a call, the booking in our calendar | Steps taken at your request before a contract, and our legitimate interest in answering and following up calls | 90 days from the call, unless the call becomes an enquiry, which then follows the enquiry period above |
| Text and WhatsApp messages to our mobile number | Your phone number, your message and the time it arrived | Steps taken at your request before a contract | 90 days from the message, unless the message becomes an enquiry, which then follows the enquiry period above |
| Enquiries passed to us by Bark or Upwork | The copy we receive from the platform: usually a name, contact details and a description of the job | Steps taken at your request before a contract | While there is a realistic prospect of working together, and no more than 3 years from our last contact |
| Doing the work we agreed | The contract, what was delivered, and correspondence that could matter in a dispute | Performance of our contract with you | 6 years after the engagement ends, the period in which a claim on a contract can be brought under the Limitation Act 1980 |
| Invoicing, accounts and tax | Billing details and the records behind them | A legal obligation we are under | 6 years after the tax year they relate to. HMRC sets this as a minimum, so we cannot delete them sooner even if you ask |
| Measuring which of our Google ads lead to enquiries, if you accept advertising cookies | The ad click reference and campaign tags from the link you followed, and whether the visit led to an enquiry. If you send an enquiry, the click reference goes with it. Google also holds what its own cookies record, under its own privacy policy | Your consent | 90 days in the cookies. A click reference sent with an enquiry follows the enquiry period above |
| Counting visits with Plausible Analytics | Pages viewed, referrer, links and buttons clicked, browser, device and approximate location, tied to a code worked out from your IP address and browser that changes every day. The IP address is discarded, and nothing is stored on your device | Our legitimate interest in knowing which pages are read | Kept as statistics with no personal data in them, for as long as we use Plausible |
| Keeping our own systems working and secure | Service logs for the chat, which record that a request happened | Our legitimate interest in running a service that works | 30 days, the default retention of the logging service |
Where we got your data, if not from you
Most of what we hold came from you directly, because you emailed us, used the chat, or became a client.
One route is different. If you posted a job on Bark or Upwork, those platforms passed your enquiry to us. We did not collect it from you, and we did not choose you.
Bark and Upwork remain responsible for their own records and their own accounts, under their own privacy notices. We are responsible only for the copy they passed to us and for what we do with it.
That copy sits in our email, our CRM, and a small tool we use to count how many enquiries each platform sends. If you would rather we did not hold it, say so and we will delete it.
When we are not the controller
Doing the work often means working inside systems a client already owns, such as their email, accounts package or CRM. The personal data in those systems belongs to the client, who decides what happens to it. For that data we act on the client's written instructions as a processor, not as a controller.
The same applies to services we run for clients, such as DMARC reports for their domains and AI assistants on their websites and phone lines. The client is the controller for the people who use them.
If you are a customer or employee of one of our clients and want to exercise your rights over data held in their systems, ask them. We will help them answer, but we cannot act on it ourselves.
Who else sees your data
HubSpot, our CRM, which holds enquiries, client contacts, and summaries of the chats and calls that become enquiries.
Google Workspace, which carries our email and calendar, and Google Cloud, which stores chat conversations in London and runs the Gemini models that draft chat replies and look up public information about a business.
Google, whose Gemini models answer our phone line through the Gemini API. The call itself runs through our own service in London, which sends the transcript to our call records.
Twilio, which provides our phone numbers and carries text and WhatsApp messages.
Cloudflare, which serves this website, stores our records of phone calls and text messages, and sorts call transcripts by topic with its own AI service.
OVHcloud, which hosts the automation server that handles the contact form and sends our notifications.
Plausible Analytics, which counts visits without cookies, with servers in the European Union.
Google, which measures our Google Ads, only if you accept advertising cookies.
Our accountant, and HMRC, for the tax records above.
We do not sell personal data. Google is the only advertising network that receives any, and only if you accept advertising cookies.
Where your data goes
Chat conversations are stored in London. Our records of phone calls and text messages are stored in Western Europe. Visit counts are stored in the European Union, which the United Kingdom recognises as offering equivalent protection.
The AI models that draft chat replies can run outside the United Kingdom. Some providers, including our CRM, our phone platform and its AI and speech providers, and Google Ads if you accept advertising cookies, process data in the United States. Those transfers rely on the UK extension to the EU-US Data Privacy Framework, or on the International Data Transfer Addendum, depending on the provider.
Ask us and we will tell you which mechanism covers a specific provider.
AI services
Chat replies are drafted by Google's Gemini models on Google Cloud, under terms that do not allow Google to use your conversation to train its models.
Phone replies come from Google's Gemini models through the paid Gemini API. Google does not use data from the paid Gemini API to train its models.
Calls to our phone line are transcribed so that we can follow up accurately. We do not keep an audio recording of the call.
Automated decisions
The chat and phone assistants reply automatically. They answer questions, can book a call or record your enquiry, and pass what you tell us to a person.
They make no decision about you. Nothing here produces a legal effect or anything similarly significant, so the rules on automated decision-making in Article 22 do not apply.
Do you have to give us anything
No. There is no statutory requirement to give us personal data.
If you want us to reply to an enquiry we need a way to reach you, and if you become a client we need enough to raise an invoice. Withhold those and we cannot do the work, but nothing else follows.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it.
You can ask us to restrict what we do with it, and you can object to processing we carry out under legitimate interests.
Where we rely on your consent or on our contract with you, and the data is held by automated means, you can ask for a copy in a portable format.
Where we rely on consent, you can withdraw it at any time. Withdrawing does not undo what was lawful beforehand. Website measurement consent is withdrawn through the Cookie settings link in the footer of any page.
To use any of them, email hello@sortasystems.com. We answer within one month.
These rights have limits. We cannot delete an invoice while HMRC still requires us to hold it, and we cannot delete records we need to defend a claim that is still live. We will tell you which applies rather than simply refusing.
Complaints
If you think we have handled your data badly, tell us first and we will try to put it right.
You can also complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113.
Changes to this notice
We update this notice when what we do changes. The date at the top shows the last update.
Cookies are covered separately
What this site stores on your device, and how to change it, is set out in the cookie policy.
Cookie policy