Privacy notice
Last updated 28 September 2026
This notice explains what personal information Duty Sorted keeps, why, who else sees it, and your rights. In short: we keep only what's needed to run the service and take payment. We don't sell your information, show adverts or track you.
Who we are
Duty Sorted is run by Bradley Cadd, a sole trader, trading as Duty Sorted. For UK data protection law, Bradley Cadd is the "controller" of your information.
Contact: [email protected]
Post: Bradley Cadd, 42 Ostrich Street, Colchester, Essex, CO3 8AS
What we keep
- Your account: your email address and business name. Your password is stored scrambled (as a "hash"), so nobody, including us, can read it.
- Your records: what you enter about your production, such as product names, strengths, volumes, dates, notes and your Small Producer Relief figures. This is mostly business information. Please don't put personal information about other people in the notes.
- Your subscription: when your free trial ends, and your subscription's status and dates. Card details go straight to our payment provider, Stripe. We never see or store them.
- Rate alerts: if you ask, on the free calculator, to be emailed when the duty rates change, your email address, and whether you've confirmed it.
- Emails: if you email us, we keep your message and email address.
- Technical records: like most websites, our hosting provider keeps short-lived server logs (including IP addresses and the pages requested) to keep the site secure and working.
Why we use it, and the legal basis
| What we do | Legal basis |
|---|---|
| Run your account and the calculator, and send emails you need, such as password resets, a welcome email and reminders about your free trial | Needed for our contract with you |
| Take subscription payments | Needed for our contract with you |
| Email you when the duty rates change, if you asked us to | Your consent, which you can withdraw at any time with the link in every email |
| Keep payment records for tax | Legal obligation |
| Keep the site secure, make backups and prevent misuse | Our legitimate interest in running a safe, reliable service |
| Tell you about important changes to the service, these terms or this notice | Our legitimate interest in keeping you informed |
Reminder emails (getting started, and before and after your free trial ends) are sent from [email protected] and each has a link to stop them. We don't send newsletters or advertising to customers. If we ever want to, we'll ask you first.
Who else sees it
We use these companies to run Duty Sorted. They handle your information only on our instructions, except Stripe, which is also responsible for some payment information itself (see Stripe's privacy policy).
| Company | What for | Where |
|---|---|---|
| DigitalOcean | Runs the website | London, UK |
| Cloudflare | Protects DigitalOcean's network and passes visits through to the website | UK and worldwide |
| Neon | Stores the database | London, UK |
| Stripe | Takes payments | UK, EU and US |
| Resend | Sends emails such as password resets | EU and US |
| GitHub | Keeps our nightly backups, locked (encrypted) so that GitHub can't read them | US |
| Namecheap | Forwards email sent to [email protected] | US |
| Google (Gmail) | Our email inbox | US and elsewhere |
Where information goes outside the UK, it's protected by the safeguards UK law requires, such as the UK's approval of the destination's data protection or approved contract terms with the company. We may also share information if the law requires it, for example with HMRC or the police.
How long we keep it
- Your account and records: until you delete your account. Deleting is immediate. Copies stay in our locked backups for up to 35 days, and are then gone for good.
- Payment records (invoices, amounts, and the email address and business name on them): for as long as UK tax law requires, currently at least 5 years after the 31 January tax return deadline for the year. This applies even after you delete your account.
- Rate alerts: until you unsubscribe, which deletes your address. If you never confirm, your address is deleted after 2 weeks.
- Emails you send us: for as long as we need them to deal with your question and any follow-up.
- Unused accounts: if an account has had no subscription and hasn't been logged into for 2 years, we may delete it, after emailing you a warning first.
Your rights
You can:
- get a copy of your information: use Download your data on your Account page, or email us;
- correct it: edit it in the site, or email us;
- delete it: use Delete your account on your Account page;
- object to or ask us to limit how we use it, in some circumstances.
Email [email protected] and we'll reply within one month. If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
Cookies
We use only cookies that are needed for the site to work securely, so we don't ask for consent:
| Cookie | What it does | How long |
|---|---|---|
sessionid | Keeps you logged in | 2 weeks, or until you log out |
csrftoken | Stops other websites sending forms in your name | 1 year |
messages | Carries a one-off note, such as "Saved", to the next page | Until that page shows |
__cf_bm | Set by Cloudflare, which protects our hosting, to tell people from automated attacks | 30 minutes |
No analytics, advertising or tracking cookies. Stripe's payment pages set their own cookies, mainly to prevent fraud (see Stripe's policy above).
Changes to this notice
If we change this notice, we'll update the date at the top. If a change matters, for example a new company handling your information, we'll email you before it takes effect.