Legal
Privacy notice
What personal data SortaSystems holds, why, how long for, and what you can ask us to do about it.
Last updated: 22 August 2026
Who we are
SortaSystems is the data controller for the personal data described here. We build custom tools, automations and integrations for small and medium businesses in the United Kingdom.
Our address for formal correspondence is 1 George Williams Way, Colchester, Essex CO1 2JS, United Kingdom. Email evan@sortasystems.com or call +44 1206 355959.
We are a small business and are not required to appoint a data protection officer. Enquiries about this notice go to the email address above and are answered by a person.
What we collect, and why
Each row is a separate purpose with its own legal ground under Article 6 of the UK GDPR.
| Purpose | What we hold | Legal ground | How long |
|---|---|---|---|
| Answering an enquiry you send us | Your name, email address, telephone number, company, and what you wrote | Steps taken at your request before a contract | While there is a realistic prospect of working together, and no more than 3 years from our last contact |
| The chat window on this site | The messages you send, our replies, the time, contact details you choose to give, and technical request identifiers (IP address, browser, and approximate country) for security and rate limiting | Steps taken at your request before a contract, and our legitimate interest in security | 90 days from your last message, or sooner if you ask |
| Enquiries passed to us by Bark or Upwork | The copy we receive from the platform: usually a name, contact details and a description of the job | Steps taken at your request before a contract | While there is a realistic prospect of working together, and no more than 3 years from our last contact |
| Doing the work we agreed | The contract, what was delivered, and correspondence that could matter in a dispute | Performance of our contract with you | 6 years after the engagement ends, the period in which a claim on a contract can be brought under the Limitation Act 1980 |
| Invoicing, accounts and tax | Billing details and the records behind them | A legal obligation we are under | 6 years after the tax year they relate to. HMRC sets this as a minimum, so we cannot delete them sooner even if you ask |
| Measuring how this website is used, if you accept cookies | Pages viewed, referrer, links clicked, browser and device, approximate location, and an identifier that recognises your browser on a later visit | Your consent | 12 months |
| Counting page views when you decline, or before you choose | Pages viewed and referrer, tied to a code our analytics provider works out on its own servers and changes every day. No location, and nothing stored on your device | Our legitimate interest in knowing which pages are read | 12 months |
| Keeping our own systems working and secure | Service logs for the chat, which record that a request happened | Our legitimate interest in running a service that works | 30 days, the default retention of the logging service |
Where we got your data, if not from you
Most of what we hold came from you directly, because you emailed us, used the chat, or became a client.
One route is different. If you posted a job on Bark or Upwork, those platforms passed your enquiry to us. We did not collect it from you, and we did not choose you.
Bark and Upwork remain responsible for their own records and their own accounts, under their own privacy notices. We are responsible only for the copy they passed to us and for what we do with it.
That copy sits in our email, our CRM, and a small tool we use to count how many enquiries each platform sends. If you would rather we did not hold it, say so and we will delete it.
When we are not the controller
Doing the work often means working inside systems a client already owns, such as their email, accounts package or CRM. The personal data in those systems belongs to the client, who decides what happens to it. For that data we act on the client's written instructions as a processor, not as a controller.
If you are a customer or employee of one of our clients and want to exercise your rights over data held in their systems, ask them. We will help them answer, but we cannot act on it ourselves.
Who else sees your data
HubSpot, our CRM, which holds enquiries and client contacts.
Google Workspace, which carries our email, and Google Cloud, which stores chat conversations in London and runs the model that drafts chat replies.
PostHog, which measures website use, hosted in the European Union.
Cloudflare, which serves this website. We store no logs of our own for it.
Our accountant, and HMRC, for the tax records above.
We do not sell personal data and we do not share it with advertising networks.
Where your data goes
Chat conversations are stored in London. Website measurement is stored in the European Union, which the United Kingdom recognises as offering equivalent protection.
Some providers, including our CRM and parts of Google's service, process data in the United States. Those transfers rely on the UK extension to the EU-US Data Privacy Framework, or on the International Data Transfer Addendum, depending on the provider.
Ask us and we will tell you which mechanism covers a specific provider.
Automated decisions
The chat assistant writes its replies automatically. It answers questions and passes what you tell us to a person.
It makes no decision about you. Nothing here produces a legal effect or anything similarly significant, so the rules on automated decision-making in Article 22 do not apply.
Do you have to give us anything
No. There is no statutory requirement to give us personal data.
If you want us to reply to an enquiry we need a way to reach you, and if you become a client we need enough to raise an invoice. Withhold those and we cannot do the work, but nothing else follows.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it.
You can ask us to restrict what we do with it, and you can object to processing we carry out under legitimate interests.
Where we rely on your consent or on our contract with you, and the data is held by automated means, you can ask for a copy in a portable format.
Where we rely on consent, you can withdraw it at any time. Withdrawing does not undo what was lawful beforehand. Website measurement consent is withdrawn through the Cookie settings link in the footer of any page.
To use any of them, email evan@sortasystems.com. We answer within one month.
These rights have limits. We cannot delete an invoice while HMRC still requires us to hold it, and we cannot delete records we need to defend a claim that is still live. We will tell you which applies rather than simply refusing.
Complaints
If you think we have handled your data badly, tell us first and we will try to put it right.
You can also complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113.
Changes to this notice
We update this notice when what we do changes. The date at the top shows the last update.
Cookies are covered separately
What this site stores on your device, and how to change it, is set out in the cookie policy.
Cookie policy