Privacy Policy

BAY38 Workwear is a trading name of Bay38 Limited (registered in England & Wales, company no. 17218099), the data controller for this site. Short version: we collect what we need to serve you, we don't sell it, and you can change your cookie choice at any time.

What we collect and why

• Account and order details: name, company, email, phone, addresses and order history, to run your account, fulfil orders and provide support (contract).
• Payment data: processed by Stripe, including PayPal, Klarna, Clearpay and Amazon Pay when you choose them at checkout. We never see or store card numbers.
• Enquiries: whatever you send us, so we can answer.
• Chat: if you use the chat on the site, your messages, and any name, email or phone number you give it, so we can answer and follow up.
• Basket reminders: if you give us your email at checkout and leave without ordering, we may email you a reminder about that basket. Every reminder carries an unsubscribe link.
• How the site is used: analytics, so we can see what works and fix what doesn't (legitimate interest).
• Advertising measurement: only if you choose Accept all (consent). See below.

My BAY38 Business, your team and linked companies

A business using My BAY38 can add the people it buys workwear, PPE and equipment for, and the companies it orders for, such as branches, depots and group companies.

• What the business adds: each person's name, their work email and phone if given, their department, site and access level, their sizes, and the kit issued to them. For a linked company: its name, addresses, contacts and the orders placed for it. Please don't enter health information (for example the reason for prescription safety glasses) in notes.
• Who is responsible: for the team list and kit records, the business is in charge and we act on its instructions, as its processor, only to supply and deliver the right kit and apply its budgets, allowances and approval rules. For logins, orders, invoices and the records the law requires us to keep, we are the controller. We never sell this information or use it to market to the people on a team.
• Our lawful bases: orders and accounts, to perform our contract with the business; logins, deliveries and security, our legitimate interest in running the service safely; order and invoice records, our legal obligation under tax law.
• Linked companies: a business can place orders for, and manage, companies it is linked to. The business confirms each linked company has agreed to this. People with access to the main account can see the orders, kit and invoices of the companies they manage.
• Team logins: if the business gives someone a login, we email them an invitation that says who we are, which business added them and what it added, with a link to this policy. They can then see their own kit, sizes and orders, and anything else their access level allows.
• Who else sees it: the providers listed below, and the delivery carriers who bring the orders (name, site address and phone, so they can deliver).
• How long: team records stay while the account is open, and the business can remove anyone at any time. If the account closes, team records are deleted within 90 days. Order and invoice records are kept for 6 years for tax law.
• Your rights: if you are on a business's team, ask your employer about your team record (they control it); if you ask us, we will pass it to them. For your login and orders, ask us at hello@bay38.com. You can object to anything we do on legitimate interests.

Cookies and tracking

The first time you visit, a bar asks you to choose Accept all or Essential only. Your choice is kept in a cookie for six months.

• Essential, always on: keep you signed in, hold your basket and remember your cookie choice.
• Analytics, on unless you choose Essential only: Google Analytics (with IP addresses anonymised) counts visits and what people do on the site. Microsoft Clarity records how pages are used, such as clicks, taps and scrolling, as session recordings and heatmaps, so we can see where the shop gets in people's way.
• Advertising, only with Accept all: Google Ads and Microsoft Advertising cookies link a purchase to the advert that brought you, so we know which adverts work. With your consent Google and Microsoft may also use this to show you our adverts on other sites. With Essential only, their tags still load but are told not to use advertising cookies.

How to opt out or change your mind

• Change your cookie choice: open cookie settings (also in the footer of every page) and pick again. Choosing Essential only switches analytics and advertising cookies off from that moment and deletes the ones already set.
• Analytics: choose Essential only in cookie settings. You can also block cookies for this site in your browser settings, or install Google's opt-out add-on at tools.google.com/dlpage/gaoptout.
• Personalised adverts: manage them with Google at myadcenter.google.com and with Microsoft at account.microsoft.com/privacy/ad-settings.
• Basket reminder emails: use the unsubscribe link in any reminder.
• Anything else: email us (below) to object to any processing.

Who processes it for us

These providers host and run parts of the service for us: payment (Stripe, plus PayPal, Klarna, Clearpay and Amazon Pay when you choose them), hosting and infrastructure (Vercel, Railway, Supabase), images and video (Cloudflare, Cloudinary), email (Google Workspace, Resend), analytics and advertising (Google, Microsoft) the chat assistant (Netlify hosts it, Anthropic's Claude writes its replies) and the map on our contact page (Google Maps). Where you accept advertising cookies, Google and Microsoft also use that data under their own privacy statements. Some providers run infrastructure outside the UK; where they do, transfers are covered by UK-approved safeguards (adequacy, or the UK International Data Transfer Agreement or Addendum).

How long we keep it

Order and invoice records: 6 years (tax law). Accounts: while active, deleted on request. Enquiries that go nowhere: up to 2 years. Your cookie choice: six months.

Your rights

Under UK GDPR you can ask for a copy of your data, correction, deletion, restriction, or portability, and object to processing. Email hello@bay38.com and we'll act within one month. Not happy with our answer? You can complain to the ICO (ico.org.uk).