1. Important information and who we are

Purpose of this notice

This notice explains how Medisort Limited collects and processes your personal data through your use of this website — including any data you provide when you request a quote or a collection, make a purchase, sign up to our newsletter, use a contact form or live chat, or take part in a competition. It also explains how we collect and process your personal data in the course of our business, including at meetings, exhibitions and networking events, and by telephone, email or post.

This website is not intended for children and we do not knowingly collect data relating to children.

Please read this notice together with any other privacy or fair processing notice we give you on specific occasions when we collect or process personal data about you, so that you are fully aware of how and why we are using your data. This notice supplements those notices and is not intended to override them.

Controller

Medisort Limited is the controller and responsible for your personal data (referred to as “Medisort”, “we”, “us” or “our” in this notice). We have appointed a data privacy manager who is responsible for overseeing questions about this notice. If you have any questions, including any requests to exercise your legal rights, please contact our data privacy manager using the details below.

Contact details

Legal entity

Medisort Limited, registered in England and Wales, company number 06856504

Data privacy manager

Karen Regester

Email

karen.regester@medisort.co.uk

Post

Medisort Limited, Fort Road, Wick, Littlehampton, West Sussex, BN17 7QU

Telephone

01903 719 646

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection (ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Changes to this notice and your duty to tell us of changes

This version was last updated on 24 September 2026. Historic versions can be obtained by contacting us. It reflects the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

2. The data we collect about you

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:

• Identity Data includes first name, last name or company. When you enquire about our services, while we provide services to you, and when you work with us, we may also collect the following when you provide it to us: your home address, date of birth, gender, nationality, National Insurance number, driving licence and passport, next of kin, allergies and any medical, physical or mental conditions, race (where relevant to a health issue or equality monitoring) and criminal offences.
• Contact Data includes billing address, collection or delivery address, email address and telephone numbers.
• Financial Data includes bank account and payment card details.
• Transaction Data includes details about payments to and from you and other details of services you have purchased from us.
• Technical Data includes internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Usage Data includes information about how you use our website and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties, and your communication preferences.

We also collect, use and share Aggregated Data, such as statistical or demographic data. Aggregated Data may be derived from your personal data but is not considered personal data in law, as it does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. If we combine Aggregated Data with your personal data so that it can identify you, we treat the combined data as personal data to be used in line with this notice.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you do not provide it when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our services). In this case, we may have to cancel a service you have with us, but we will tell you if this is the case at the time.

3. How your personal data is collected

We use different methods to collect data from and about you, including:

Direct interactions

You may give us your Identity, Contact, Financial, Transaction, Profile and Marketing and Communications Data by filling in forms, in live chat, during meetings or by corresponding with us by post, phone, email, text message, social media messaging or otherwise. This includes personal data you provide when you:

• book a collection;
• apply for or request our services, or ask for a quote;
• subscribe to our services or publications;
• join a loyalty programme;
• request marketing to be sent to you;
• leave a comment on our website;
• enter a competition, promotion or survey;
• give us feedback;
• contact us with an enquiry or to report a problem;
• work as a subcontractor for us.

Automated technologies or interactions

As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this data using essential cookies and similar technologies, and — only if you allow them — analytics and marketing cookies. See theCookies section below.

Third parties or publicly available sources

We may receive personal data about you from various third parties and public sources, as set out below:

• Technical Data from analytics providers, advertising networks and search information providers — only where you have allowed the relevant cookies. No analytics or marketing service is currently connected to this website.
• Your employer, and credit checking agencies where applicable.
• Identity and Contact Data from publicly available sources such as Companies House and the Electoral Register, based in the UK.
• Identity and Contact Data provided at events, such as business cards or attendee lists.
• Identity and Contact Data from data brokers or aggregators based in the UK.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data:

• where we need to perform the contract we are about to enter into, or have entered into, with you;
• where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
• where we need to comply with a legal or regulatory obligation;
• for special category data, where processing is necessary for carrying out obligations and exercising rights in the field of employment, social security and social protection law (UK GDPR Article 9(2)(b)).

We rely on consent as one of the legal bases for processing your personal data where you have given it. We will only send you third-party direct marketing by email or text message with your consent. You have the right to withdraw consent to marketing at any time by contacting us.

Purposes for which we will use your personal data

The table below describes the ways we plan to use your personal data and the legal bases we rely on to do so, including our legitimate interests where appropriate. We may process your personal data for more than one lawful ground depending on the specific purpose. Please contact us if you need details about the specific legal ground we are relying on.

Marketing

We aim to give you choices about how we use your personal data, particularly for marketing and advertising. We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what you may want, need or be interested in. This is how we decide which services and offers may be relevant for you.

You will receive marketing communications from us if you have opted in, requested information from us, purchased services from us or given us your details when entering a competition — and, in each case, you have not opted out of receiving that marketing.

Third-party marketing

We will get your express opt-in consent before we share your personal data with any company outside Medisort Limited for marketing purposes.

Opting out

You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out or unsubscribe link in any marketing message, or by contacting us. Where you opt out, we will keep a restricted record of your Contact and Identity Data so that no future marketing is sent to you; unless you tell us otherwise, we will not process that record for anything else.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If you would like an explanation of how the new purpose is compatible with the original one, please contact us. If we need to use your personal data for an unrelated purpose, we will tell you and explain the legal basis that allows us to do so. We may process your personal data without your knowledge or consent, in line with these rules, where this is required or permitted by law.

5. Who we share your personal data with

We may share your personal data with the parties below for the purposes set out in the table in section 4:

• External third parties, as set out in the Glossary.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets, or businesses we may seek to acquire or merge with. If our business changes in this way, the new owners may use your personal data in the same way as set out in this notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes, and only permit them to process it for specified purposes and in accordance with our instructions.

6. International transfers

Some of the service providers we use are based outside the UK, so their processing of your personal data may involve a transfer of data outside the UK. Whenever we transfer your personal data out of the UK, we make sure it is given a similar degree of protection by using at least one of the following safeguards:

• We transfer your personal data to countries that the UK Government has found to provide an adequate level of protection for personal data, which include the countries of the European Economic Area.
• Where we use providers based in the United States, we rely on the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”) where the provider is certified under it, or otherwise on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Please contact us if you would like more information on the specific mechanism we use when transferring your personal data out of the UK.

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality.

We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. Data retention

We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting or reporting requirements. To decide the right retention period, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether we can achieve those purposes through other means, and the applicable legal requirements.

9. Your legal rights

You have the right to:

• Request access to your personal data (a “data subject access request”). This lets you receive a copy of the personal data we hold about you and check that we are lawfully processing it.
• Request correction of the personal data we hold about you, though we may need to verify the accuracy of any new data you give us.
• Request erasure of your personal data where there is no good reason for us to continue processing it, where you have successfully objected to processing, where we may have processed it unlawfully, or where we must erase it to comply with the law. We may not always be able to comply for specific legal reasons, which we will explain at the time.
• Object to processing where we rely on a legitimate interest and something about your situation makes you want to object, and at any time to processing for direct marketing. In some cases we may have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing: (a) while we establish the data’s accuracy; (b) where our use is unlawful but you do not want us to erase it; (c‌) where you need us to hold the data to establish, exercise or defend legal claims even though we no longer need it; or (d) while we verify whether we have overriding legitimate grounds after you have objected.
• Request a transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format. This applies to automated information you gave consent for us to use, or that we used to perform a contract with you.
• Withdraw consent at any time where we rely on consent. This does not affect the lawfulness of processing carried out before you withdraw it. If you withdraw consent, we may not be able to provide certain services to you, and we will tell you if this is the case.

If you wish to exercise any of these rights, please contact us.

No fee usually required

You will not have to pay a fee to access your personal data or to exercise any of your other rights. However, we may charge a reasonable fee, or refuse to comply, if your request is clearly unfounded, repetitive or excessive.

What we may need from you

We may need specific information from you to confirm your identity before we act on your request. This is a security measure to make sure personal data is not disclosed to anyone who has no right to receive it. We may also contact you for more information to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. It may occasionally take longer if your request is particularly complex or you have made several requests; if so, we will tell you and keep you updated.

10. Cookies

Cookies are small text files that a website stores on your computer, phone or tablet. Websites can also use similar technologies, such as local or session storage in your browser, or pixels. We ask for your consent before using anything that is not essential, and nothing optional is switched on until you choose it.

If we connect an analytics or marketing service in future, we will name it here, and it will only run if you have allowed that category. Other websites you visit, and third parties such as advertising networks, may use their own cookies, which we do not control.

Changing your choice

You can change or withdraw your choice at any time using the button below, or the cookie button in the corner of every page. Withdrawing a choice stops that category being used from then on. You can also block or delete cookies in your browser settings, but if you block essential cookies some parts of this website may not work.

11. Glossary

Lawful basis

Legitimate interest means the interest of our business in conducting and managing our business to give you the best service and the best and most secure experience. We make sure we consider and balance any potential impact on you, and your rights, before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or permitted to by law. You can find out more about how we assess our legitimate interests against any potential impact on you by contacting us.

Performance of contract means processing your data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary to comply with a legal or regulatory obligation that we are subject to.

External third parties

• External social, medical and healthcare professionals, and any individuals you have nominated as your representatives, where this is needed to arrange the service you need.
• Service providers acting as processors who provide IT and system administration, email, payment processing, electronic contract signing and data shredding services. Some are based outside the United Kingdom (see International transfers).
• Our website hosting and delivery provider, which processes Technical Data such as your IP address to deliver and protect this website, and processes the details you submit through our online forms so that they reach us.
• Our live chat provider, Crisp IM SAS, based in France, acting as a processor when you choose to start a live chat.
• Postcode lookup services, such as Postcodes.io, when you enter a postcode so we can show the right options for your area.
• Service providers we engage to deliver goods you have ordered.
• Professional advisers and bodies acting as processors or joint controllers, based in the United Kingdom, including lawyers, bankers, auditors, credit reference agencies, marketing companies, HR companies, accountants, bookkeepers, payroll and pension companies, compliance specialists, insurers, and anti-money laundering and fraud register providers.
• HM Revenue & Customs, regulators and other authorities based in the United Kingdom who require reporting of processing activities in certain circumstances.
• Data protection authorities, the police and other crime prevention and detection agencies, where required.
• Marketing automation platforms acting as processors, such as The Rocket Science Group LLC trading as Mailchimp, based in the United States, who provide email marketing services.
• Survey platforms acting as processors, such as SurveyMonkey Inc. and SurveyMonkey Europe UC, based in the United States and Ireland, who provide online survey services.
• Social media platforms acting as processors or joint controllers.