Your data, in plain English.

sorted. is a trading name of BAGUI BRANDS LTD, a company registered in England and Wales (company number 16933635). We decide how your personal data is used, which makes us the "controller" under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Our address is 71-75 Shelton Street, London WC2H 9BH. For anything about your data, email us at admin@sortedclean.co.uk.

• Contact details: your name, delivery and billing address, email address and, if you give it, your phone number.
• Order and plan details: what you buy, your refill bundle, how often it comes, and any skips, pauses, cancellations or returns.
• Your washing habits: how many washes you do a week, if you tell us, so we can time your refills.
• Payment details: payments are handled by Shopify's checkout. We only see the card type, the last four digits and whether the payment went through.
• Account details: your login email and account settings.
• Messages: anything you send us, including photos of a damaged parcel.
• Device and browsing data: your IP address, browser, device, the pages you look at and how you found us. Some of this comes from cookies (see Cookies).

We don't ask for sensitive information, like health details. If you mention something like a skin condition when you email us, we'll only use it to answer your question.

The law says we need a valid reason, called a "lawful basis", for each way we use your data. Here's what we do and the reason for each.

• Sending your order and running your plan. Taking payment, packing and sending boxes, timing your refills, emailing order and plan updates, and handling returns and refunds. Reason: we need it to do what you've asked us to do (our contract with you).
• Answering your messages. Helping with questions, problems and complaints. Reason: our contract with you, and our legitimate interest in giving good service.
• Keeping records. Keeping order and payment records for tax and consumer law. Reason: the law requires it.
• Stopping fraud and keeping the shop safe. Checking for fraudulent orders and protecting our website. Reason: our legitimate interest in protecting our business and our customers.
• Making the shop better. Looking at how people use the website, so we can fix what doesn't work. Reason: our legitimate interest in improving the shop. If this uses cookies that aren't essential, we ask you first.
• Marketing emails. Offers, news and tips, only if you've signed up. Reason: your consent. You can unsubscribe any time.
• Ads on Facebook and Instagram. Measuring how our ads do and showing sorted. ads to people who might like them. Reason: your consent, which you give on our cookie banner.

When we rely on our legitimate interests, we've checked that our reasons don't outweigh your rights. You can object at any time (see Your rights).

We don't make decisions about you using only automated systems. Shopify runs automatic fraud checks on orders, but a person at sorted. looks at any flagged order before we cancel it.

We never sell your personal data. We only share it with companies that help us run sorted., and only what they need to do their job:

• Shopify runs our website, checkout and customer accounts, and processes payments.
• Recharge runs refill plans: billing dates, skips, pauses and cancellations.
• Klaviyo sends our emails, including order updates and, if you've signed up, our newsletter.
• Meta (Facebook and Instagram) gets data from the Meta Pixel on our website, but only if you accept marketing cookies.
• Delivery companies get your name and address, and sometimes your email or phone number, so they can deliver your parcel and send tracking updates.
• Our warehouse packs and sends orders and checks returns.
• Professional advisers, like our accountants and lawyers, when they need it.

These companies can only use your data for the work we've asked them to do, under contracts that protect it. Shopify and Meta also use some data for their own purposes, such as fraud prevention or improving their ads, under their own privacy policies: Shopify and Meta.

We'll also share data if the law says we must, for example with HMRC. If sorted. is ever sold, your data would pass to the new owner, who would have to keep looking after it in line with this policy.

Some of these companies, including Shopify, Recharge, Klaviyo and Meta, store or access data outside the UK, for example in the US, Canada or the EU.

When that happens, we make sure your data is protected to UK standards. Either the UK government has approved the country (or, for the US, the company, under the UK-US "data bridge"), or we use contracts approved by the ICO, such as the International Data Transfer Addendum.

Cookies are small files saved on your device when you visit a website. We use three kinds:

• Essential cookies make the shop work: your basket, checkout, login and security. These are always on.
• Analytics cookies show us how people use the website, so we can improve it.
• Marketing cookies, like the Meta Pixel and Klaviyo's tracking, help us measure our ads and emails and show sorted. ads to people who might like them.

We only use analytics and marketing cookies if you say yes on our cookie banner. To change your mind, clear the cookies for our website in your browser and the banner will ask you again.

• Orders, payments and refunds: 6 years, because UK tax law requires it.
• Your account and plan: for as long as your account is open. If you ask us to close it, we delete everything we don't have to keep for tax.
• Messages with us: 6 years after we last spoke, in line with our order records.
• Marketing emails: until you unsubscribe. After that we keep your email address on a "do not email" list, so we don't contact you again by mistake.
• Cookies: each cookie runs out on its own. You can delete them any time in your browser.

Under UK law, you have the right to:

• See your data. Ask for a copy of what we hold about you.
• Correct it. Ask us to fix anything that's wrong or out of date.
• Delete it. Ask us to delete your data, unless the law says we must keep it.
• Limit it. Ask us to stop using your data while a problem is sorted out.
• Object. Say no to anything we do based on our legitimate interests, and to marketing at any time.
• Take it with you. Ask for your data in a format you can give to another company.
• Change your mind. Withdraw your consent at any time. This doesn't affect anything we did before.

To use any of these rights, email admin@sortedclean.co.uk. It's free. We may ask you to prove who you are, and we'll reply within one month. If a request is complicated, the law lets us take up to two months more, and we'll tell you if we need to.

Click "unsubscribe" at the bottom of any marketing email, or email us. You'll still get emails about your orders and your plan, because those aren't marketing.

Payments go through Shopify's secure checkout, which meets the card industry's security standard (PCI DSS). Only people who need customer data for their job can see it.

No system is perfect. If something ever goes wrong and puts your data at risk, we'll tell you and the ICO when the law says we must. Please keep your account password to yourself.

If we change how we use your data, we'll update this page and the date at the top. If it's a big change, we'll email you too.

If you're not happy with how we've handled your data, please tell us first and we'll do our best to put it right.

You can also contact the ICO, the UK data regulator, at ico.org.uk.