Last updated: September 2026
1. Introduction
This Privacy & Cookies Policy (the "Policy") explains how Soreto Limited, company number 10382580, of 1st Floor, 12 Soho Square, London W1D 3QF ("Soreto", "we", "us" or "our") processes personal data.
This Policy applies when you:
- use our website at https://www.soreto.com/ (the "Website");
- contact Soreto through the Website or otherwise communicate directly with us; or
- participate in a referral or advocacy programme powered by Soreto on behalf of one of the retailers or other businesses we work with (each a "Retailer").
Soreto provides technology and services that enable Retailers to operate customer referral and advocacy programmes.
A Soreto-powered referral experience (a "Referral Experience") may be made available through a Retailer's website, mobile application or other digital platform and may include website placements, lightboxes, overlays, embedded experiences, landing pages or other referral interfaces.
A Referral Experience may enable you to participate as a person sharing an offer with another person (a "Referrer") or as a person receiving or using an offer shared with them (a "Friend").
References in this Policy to a "Referral Programme" include the Referral Experience and associated referral, tracking, validation and Reward administration activities carried out by Soreto on behalf of a Retailer.
We may update this Policy from time to time. Where appropriate, we will notify you of material changes through the Website, the relevant Referral Experience or another appropriate method. The date on which this Policy was last updated is shown above.
2. Who Is Responsible for Your Personal Data?
The role Soreto performs under data protection law depends upon the context in which your personal data is processed.
2.1 Soreto as Controller
Soreto is the controller where we determine the purposes and means of processing personal data ourselves. This includes, for example, personal data that you provide directly to Soreto when contacting us through our Website and certain technical information processed in connection with the operation, security and improvement of our Website and services.
Soreto is registered with the Information Commissioner's Office ("ICO") under registration number ZA221126.
2.2 Soreto as Processor for Referral Programmes
Where Soreto processes personal data in order to provide and administer a Referral Programme on behalf of a Retailer, the applicable Retailer is the data controller and Soreto acts as its data processor.
This includes personal data processed by Soreto to enable participation in the Referral Programme, administer referrals and Rewards, track and validate referral activity and provide associated programme communications.
The applicable Retailer's privacy policy provides further information about how the Retailer processes your personal data, including the legal basis upon which it instructs Soreto to process that data.
Where Soreto acts as a processor, we process personal data on behalf of and in accordance with the instructions of the applicable Retailer and our contractual obligations to that Retailer.
3. Personal Data We Collect
3.1 Information You Provide Directly to Soreto
If you contact Soreto through the Website or otherwise contact us directly, we may collect:
- your name;
- your email address;
- the company or organisation you represent, where applicable;
- the subject of your enquiry; and
- any information you include within your message or correspondence.
3.2 Information Processed When You Participate in a Referral Programme
Where you participate in a Referral Programme, Soreto may process information including:
- your first name;
- your email address;
- information identifying the applicable Retailer and Referral Programme;
- referral links and referral identifiers;
- information relating to referral activity;
- information relating to Rewards and Reward status;
- relevant transaction information required to track and validate a referral, such as an order or transaction identifier, order value and transaction or validation status; and
- information necessary to administer, investigate or respond to a query concerning a referral or Reward.
Your name and email address may be provided to Soreto by the applicable Retailer or entered directly by you into the Referral Experience.
Soreto does not require or process payment-card details in order to operate the Referral Programme.
3.3 Information About Friends
Where you are a Referrer, Soreto does not require you to provide us with your Friend's name or contact details in order to share a Referral Link.
Where you choose to share a Referral Link using a messaging application, social network, email service or another third-party sharing service, you choose the recipient and initiate the communication through that service.
Soreto may provide the Referral Link and suggested sharing content, but we do not obtain the Friend's contact details merely because you choose to share that content with them.
Where a Friend follows a Referral Link and interacts with the Referral Experience, Soreto may then process information relating to that interaction as described in this Policy.
3.4 Technical, Tracking and Fraud-Prevention Information
When you use the Website, follow a Referral Link or interact with a Referral Experience, Soreto may process limited technical and tracking information. Depending upon the relevant service and your cookie choices, this may include:
- IP address;
- browser and User-Agent information;
- referral source;
- the Referral Link or referral identifier used;
- date and time of interaction;
- cookie or similar technology identifiers; and
- information concerning interactions with the Referral Experience.
This information may be used to enable referral tracking, maintain the integrity of Referral Programmes, identify trends, investigate technical issues and help detect or prevent fraud, misuse or manipulation.
4. How We Use Personal Data
4.1 Website and Direct Enquiries
Where you contact Soreto directly, we may use your information to:
- respond to your enquiry;
- provide information requested by you;
- administer our relationship with you or the organisation you represent;
- operate and improve our Website; and
- maintain the security and integrity of our systems.
4.2 Referral Programmes
Where Soreto acts as processor on behalf of a Retailer, personal data may be processed to:
- enable you to enrol in or participate in a Referral Programme;
- generate and administer Referral Links;
- identify referrals associated with a particular Referrer or Referral Programme;
- track referral activity;
- determine whether a Friend has completed a potentially qualifying transaction;
- reconcile, track and validate transactions;
- identify whether a transaction has been cancelled, returned, refunded or otherwise invalidated;
- administer and issue Rewards once applicable conditions have been satisfied;
- maintain the integrity and security of the Referral Programme;
- identify and investigate suspected fraud, abuse or manipulation;
- respond to customer queries concerning referrals or Rewards; and
- provide reporting relating to the operation and performance of the Referral Programme to the applicable Retailer.
4.3 Programme Communications
Where necessary to administer a Referral Programme, Soreto may send service or programme-administration communications on behalf of the applicable Retailer. These may include:
- confirmation of participation in the Referral Programme;
- information about the applicable Reward;
- referral or Reward status communications;
- information required to administer or validate a referral; and
- delivery or confirmation of a Reward once the applicable conditions have been satisfied.
These communications relate to the operation of the Referral Programme and are separate from general marketing communications. In some Referral Programmes, equivalent communications may instead be sent directly by the Retailer.
5. Tracking, Attribution and Affiliate Networks
Some Retailers use an affiliate network or other tracking provider to track and validate transactions generated through a Referral Programme.
Where applicable, a Friend who follows a Referral Link may be redirected to the Retailer's platform using tracking technology that enables the resulting transaction to be associated with the referral.
The applicable affiliate network or tracking provider may provide Soreto with relevant transaction information, such as an order identifier, transaction value and validation status, so that Soreto can administer the Referral Programme and determine whether the applicable conditions for a Reward have been satisfied.
Transactions may be subject to the Retailer's existing attribution, validation, cancellation and returns rules. Soreto only processes the information required for the operation and administration of the relevant Referral Programme.
6. Legal Grounds for Processing
6.1 Where Soreto Is Controller
Where you contact Soreto directly, we may process your information where necessary to respond to your request, take steps at your request or pursue our legitimate interests in operating and administering our business.
Where cookies or similar technologies require consent, we rely upon your consent. We may also process information where necessary to comply with a legal obligation or where otherwise permitted or required by law.
6.2 Where Soreto Is Processor
Where Soreto processes personal data to provide and administer a Referral Programme on behalf of a Retailer, Soreto acts as a data processor.
The applicable Retailer, as controller, is responsible for determining the lawful basis upon which your personal data is processed for the Referral Programme. You should consult the applicable Retailer's privacy policy for further information about its processing of your personal data.
7. Sharing Personal Data
Soreto does not sell personal data.
We may share or make personal data available where necessary to provide our services, comply with legal obligations or operate the relevant Referral Programme. Depending upon the circumstances, recipients may include:
- the applicable Retailer;
- hosting and infrastructure providers;
- technology and service providers acting on our behalf;
- affiliate networks or tracking providers involved in the applicable Referral Programme;
- professional advisers where reasonably necessary;
- regulators, including the ICO;
- law-enforcement authorities or other public bodies where required by law; and
- a purchaser, investor or other relevant party in connection with a proposed or completed sale, restructuring or reorganisation of Soreto or its business.
Where a service provider processes personal data on our behalf, we require appropriate data-protection and security arrangements. We may also use aggregated or anonymised information that does not identify individuals for reporting, analysis and service-improvement purposes.
8. Third-Party Services and Sharing Channels
A Referral Experience may enable you to use third-party services such as messaging applications, social networks, email providers or other sharing platforms.
Where you choose to use one of those services, your use of that service is governed by the third party's own privacy policy and terms.
Soreto is not responsible for the privacy practices of third-party services or Retailer websites. You should review the privacy information provided by any third-party service or Retailer with which you interact.
9. Security
Soreto has implemented technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or misuse.
Access to personal data is restricted to authorised personnel and service providers who require access for legitimate business or service purposes.
We regularly review our technical and organisational measures and update them where appropriate having regard to the nature of the information processed and the risks associated with the processing.
No internet-based service can be guaranteed to be completely secure, but we take reasonable and appropriate steps to protect the personal data processed through our services.
10. Storage and Data Retention
Soreto stores Referral Programme personal data within the European Economic Area ("EEA").
Where Soreto processes personal data on behalf of a Retailer to administer a Referral Programme, the relevant referral programme data is generally retained by Soreto for six months, after which it is deleted in accordance with our data-retention processes, unless a different period is required by law or agreed with the applicable Retailer where legally permissible.
The six-month retention period reflects the lifecycle of a referral. For example, a Referral Link may remain valid for a period before a Friend completes a purchase. The resulting transaction may then remain subject to the Retailer's cancellation or returns period and may subsequently require validation through an affiliate network or other tracking provider.
The full process from initial referral to final validation can therefore extend over several months. The six-month period also provides a reasonable period in which Soreto and the Retailer can investigate and resolve subsequent customer queries concerning a referral or Reward.
Personal data processed by Soreto for other purposes is retained only for as long as reasonably necessary for the purpose for which it was collected, taking account of applicable legal, regulatory, contractual and operational requirements.
11. Cookies and Similar Technologies
11.1 What Are Cookies?
Cookies are small text files placed on your device when you use a website or interact with certain online services.
Cookies and similar technologies may be used to enable functionality, remember settings, support referral tracking, understand how services are used and help protect Referral Programmes against fraud or misuse.
Cookies may be either session cookies, which are generally deleted when you close your browser, or persistent cookies, which remain on your device for a specified period or until deleted.
11.2 Soreto Cookies and Referral Tracking
Soreto may use cookies and similar technologies in connection with the Website and Referral Experiences. These may be used to:
- provide Website or Referral Experience functionality;
- recognise referral interactions;
- associate activity with the appropriate Retailer or Referral Programme;
- prevent one referral interaction from incorrectly overwriting another;
- support attribution and validation;
- understand use of the Website or Referral Experience; and
- help identify and prevent fraud or misuse.
Where required by applicable law, non-essential cookies and similar technologies will only be used with the appropriate consent.
11.3 Current Cookie Technologies
Soreto's current Website Privacy Policy identifies the following technologies:
User Cookies
reverbToken — described as containing user details for users signed up to the Website.
Referral Tracking Cookie
soreto_chocolat_chip — described as containing information about the Soreto link clicked and when the interaction occurred.
The current policy also identifies Google Analytics and Hotjar as third-party technologies.
Soreto will maintain information about cookies and similar technologies used by the Website and Referral Experiences in accordance with applicable requirements.
11.4 Managing Cookies
Where applicable, you can manage your cookie preferences through the consent controls made available on the Website or relevant Referral Experience. You may also be able to control cookies through your browser settings.
Disabling certain cookies may affect the operation of parts of the Website or Referral Experience and, where tracking is necessary to associate a transaction with a referral, may prevent the relevant referral from being successfully tracked.
12. International Transfers
Where personal data is transferred outside the United Kingdom or EEA, Soreto will ensure that appropriate safeguards are in place where required by applicable data-protection law. These safeguards may include an applicable adequacy decision or approved contractual protections.
Where Soreto acts as processor for a Retailer, international transfers are also subject to the arrangements agreed with that Retailer.
13. Your Data-Protection Rights
Depending upon the circumstances and applicable law, you may have rights in relation to your personal data, including the right to:
- request access to personal data concerning you;
- request correction of inaccurate or incomplete personal data;
- request deletion of your personal data;
- request restriction of processing;
- object to certain processing;
- withdraw consent where processing is based upon consent; and
- request transfer of personal data in circumstances where the right to data portability applies.
Where your request concerns personal data that Soreto processes on behalf of a Retailer as data processor, the applicable Retailer is responsible for responding to your request as controller.
If you contact Soreto directly in relation to such information, we may refer your request to the relevant Retailer and/or assist the Retailer in responding to it. These rights are subject to the conditions and exemptions contained in applicable data-protection law.
14. Complaints
If you have concerns about the way in which your personal data has been processed, you can contact us using the details below.
You also have the right to make a complaint to the Information Commissioner's Office. Information about the ICO and how to make a complaint is available at https://ico.org.uk/.
Where your concern relates to a Referral Programme for which the Retailer is controller, you may also wish to contact the applicable Retailer directly.
15. Contacting Soreto
If you have a question about this Policy or the way Soreto processes personal data, you can contact us at:
Email: info@soreto.com
Post:
Data Protection Query
Soreto Limited
1st Floor
12 Soho Square
London
W1D 3QF
United Kingdom