Data Protection Policy

Effective: 2026
Controller: Book Writting Ltd
Site: bookwritting.com

This Data Protection Policy sets out how Book Writting Ltd (“Book Writting”, “we”, “us”, “our”) designs, runs and accounts for the handling of personal data in our ebook store, Book Clubs, author platform and publishing services. It is written for a book business: readers who buy and download works, authors who submit manuscripts, and the people who work with us to get a book into the world.

It sits alongside our Privacy Policy (what we tell you when we collect data), our Cookie Policy, our Terms & Conditions and our User Agreement. If a notice at the point of collection is more specific than this Policy, that notice applies to that collection.

We process personal data under the UK General Data Protection Regulation, the Data Protection Act 2018, and — where it applies to a visitor or customer — the EU GDPR. Nothing in this Policy limits a right the law says cannot be limited.

1. Who is responsible

Book Writting Ltd is the data controller for personal data collected through bookwritting.com and our related services, unless we clearly tell you that another organisation is the controller (for example, a payment firm that handles your card details on its own terms).

Registered in England and Wales, company number 15254267.
Registered office: 37 McDougall Road, Wednesbury, England, WS10 0TH.

Privacy and data-protection requests: hello@bookwritting.com or our Contact page, using the subject line “Data protection”.

We are a specialist publishing company, not a consumer-tech giant. We have not appointed a statutory Data Protection Officer because our core activities do not consist of large-scale regular monitoring or large-scale processing of special-category data as those terms are used in UK GDPR. Accountability still sits with the directors of Book Writting Ltd.

2. The people this Policy covers

• Visitors — anyone who opens the site without an account.
• Readers — people who register to browse, buy, download, subscribe, join Book Clubs or keep a member page.
• Authors and applicants — people who apply for an author account, submit a manuscript, buy a promotion, or commission writing, editing, design, audio or publishing work.
• Affiliates — people who apply to promote titles and, if approved, share a referral link.
• Correspondents — anyone who writes to us, including quote requests from the Services page.
• Public contributors — people who post in Book Clubs, short stories, events or comments that others can read.

This Policy does not cover staff or contractor HR files, which are handled under internal employment notices.

3. Principles we work to

We treat personal data as we would expect a reputable house to treat an unpublished manuscript: only what is needed, only for a stated purpose, kept no longer than it earns its keep, and protected against curious or careless hands.

In legal terms we commit to:

• Lawfulness, fairness and transparency — a lawful basis for each use, and clear language about it.
• Purpose limitation — we do not recycle a checkout email into an unrelated product without a fresh basis.
• Data minimisation — we ask for a billing name, not a life story, unless you are commissioning a book.
• Accuracy — you can correct your account; we correct records when we learn they are wrong.
• Storage limitation — see the retention table in section 10.
• Integrity and confidentiality — access is limited; paid ebook files are not published as open URLs.
• Accountability — we can explain what we hold and why, including to the Information Commissioner’s Office.

4. Categories of personal data

4.1 Identity and account

Name, email, password (stored as a one-way hash, never as readable text), account type (reader or author), application status, affiliate code where relevant, and records of email verification and adult-access confirmation.

4.2 Commerce

Orders, titles purchased, prices, download grants, complimentary free-book access, subscription plan and period, promotion and advert purchases, and payment status. Card numbers are collected by our payment processor, not stored in full in our databases. We keep the tokens, last-four digits or receipt references the processor returns so we can match a payment to an order.

4.3 Reading and catalogue use

Titles you add to a cart, complete, or open from My books; Adult books access after you confirm you are 18 or older; search queries you type into Find a book. We use this to deliver the file, prevent abuse of download limits, and improve the catalogue — not to sell a dossier of your reading taste to advertisers.

4.4 Manuscripts and publishing files

Work you upload or send for a quote, submission or service — manuscripts, covers, transcripts, ISBNs, briefs and correspondence. We treat unpublished work as confidential commercial material as well as personal data where it identifies you. Staff and contractors see it only to assess, produce or publish the work you asked for. We do not use your unpublished manuscript to train a public model or to write another customer’s book.

4.5 Community

Book Club posts, short stories, member-page text, events you create or join, and comments. If you publish them on the site, other users can read them. You should not put another person’s private details in a public post.

4.6 Technical

IP address, browser and device type, pages viewed, cookie identifiers, approximate location derived from IP, and security logs (sign-in attempts, throttling). See the Cookie Policy for optional analytics cookies.

4.7 Support

Messages sent through Contact, including name, email, subject and the body of the enquiry, stored so our team can reply even if email delivery fails.

5. Special category and age-gated data

We do not seek health, political, religious or biometric data as a condition of using the store.

The public ebook list does not include titles we class as discussing sexual activity. Those titles sit behind an Adult books area. To enter it you must confirm you are 18 or older. That confirmation is a record of a statement you made, not a copy of a passport, unless a payment or fraud review later requires identity checks under the law.

If a manuscript or Book Clubs post you send us happens to contain special-category information, we process it only as part of providing the service you asked for, or to keep the platform safe, and we do not use it for marketing.

6. Children

bookwritting.com is aimed at adults. Author applications, paid services, subscriptions and Adult books are for people aged 18 or over (or the age of majority where that is higher).

We do not knowingly create accounts for children. If you believe we hold data about a child, contact us and we will delete the account and related personal data unless we must keep a fragment of it to comply with law (for example a tax invoice already issued).

7. Why we process data, and on what lawful basis

Purpose	Typical data	Lawful basis (UK GDPR)
Create and run your account, sign you in, reset a password	Identity, security logs	Contract (Art. 6(1)(b)); legitimate interests in keeping accounts secure (Art. 6(1)(f))
Sell and deliver ebooks, free files, promotions and adverts	Orders, download grants, title metadata	Contract
Run a subscription (audio, podcast, summaries, toolkit access)	Plan, renewal dates, usage allowances	Contract
Review author, affiliate and service applications; produce commissioned work	Application forms, manuscripts, briefs	Contract, or steps prior to contract (Art. 6(1)(b))
Age-gate Adult books	18+ confirmation, timestamp	Legitimate interests in keeping adult titles off the open catalogue; legal obligation where obscenity or age-restriction law requires it
Book Clubs, member pages, short stories, events	Profile and posts you choose to publish	Contract; legitimate interests in operating a literary community
Customer support and quotes	Contact messages	Contract or legitimate interests in answering you
Service emails (order receipts, download notices, security alerts)	Email, order facts	Contract; legitimate interests
Optional newsletters or marketing about our own titles and services	Email, name	Consent where the law requires it; otherwise legitimate interests with a clear opt-out. You can stop marketing without losing the store.
Prevent fraud, abuse of downloads, spam and attacks	Logs, order patterns	Legitimate interests; legal obligation
Accounts, tax and dispute records	Invoices, refunds, chargebacks	Legal obligation; legitimate interests
Improve the catalogue and site (aggregated or lightly identified analytics)	Usage, cookies as described in the Cookie Policy	Legitimate interests, or consent for non-essential cookies

Where we rely on legitimate interests, we have considered whether the same result could be achieved with less data, and whether a reader or author would reasonably expect the use. You may object — see section 12.

We do not sell personal data. We do not rent our customer list. We do not permit a third party to present you with advertising based on a profile we built of your private reading, except where you have asked for a promotion of your own book.

8. How we collect it

• Directly from you — registration, checkout, applications, uploads, Contact, Book Clubs, Find a book queries, cookies you accept.
• Automatically — server and security logs, cookies and similar tools described in the Cookie Policy.
• From payment and identity providers — confirmation that a payment succeeded or failed, and limited card metadata.
• From you about other people — only if you have a right to share it (for example a co-author you name on a submission). You must not upload a manuscript that contains someone else’s personal data unless you have a lawful reason.

We do not buy marketing lists to populate Book Writting accounts.

9. Who we share data with

We share personal data only where a task cannot be done in-house, and then under a written arrangement that limits use to our instructions, except where that party is itself a controller (banks, tax authorities, the payment scheme).

Typical recipients:

• Payment processors and banks — to take, refund or dispute a charge.
• Hosting, backup and email infrastructure — to keep the site and notices running.
• Professional advisers — solicitors, accountants, insurers, when a matter requires it.
• Regulators, courts and law enforcement — when the law requires disclosure, or to protect rights, safety or the integrity of the catalogue.
• A buyer of the business — if Book Writting Ltd (or its assets) is sold, data needed to continue the store moves with it, still bound by this Policy until replaced.
• Other users — only what you chose to make public (author page, Book Clubs, short stories) or what must appear on an order you asked us to fulfil.

Contractors who see a manuscript (an editor, designer or narrator we engage for your job) see it to perform that job. They are not free to republish it.

Find a book is a on-site catalogue assistant. Queries are processed to search our public ebook list and to answer how-to questions. They are not sent to an external generative-AI consumer chatbot as your private brief.

10. How long we keep it

We keep personal data only while a purpose remains. When that purpose ends we delete or irreversibly anonymise it, unless a law requires a longer hold.

Record	Typical period
Account profile	Life of the account, then up to 12 months after closure while we wind down downloads and support, unless you ask us to erase sooner and no exception applies
Orders, invoices, refunds	Six years after the end of the tax year of the transaction (UK accounting practice), then review for deletion
Download and access logs	Up to 24 months, longer if a fraud or chargeback file is open
Subscription history	Life of the subscription plus six years for billing disputes
Manuscripts for a declined or withdrawn submission	Up to 12 months after the decision, unless you ask us to delete sooner
Manuscripts and files for an accepted or commissioned work	For the life of the publishing or service relationship and the period we must defend copyright, payment or quality claims — commonly six years after the last active contract year
Adult 18+ confirmation	While Adult books access remains on the account, then deleted with the account
Contact messages	Up to 24 months after closure of the enquiry
Public Book Clubs posts and member pages	Until you delete them or the account is closed, subject to backup cycles and any legal hold
Security and server logs	Usually 12 months, longer if an incident is under review
Marketing consents and suppression lists	Consent while active; suppression (so we do not email you again) until it is no longer needed

Backups are overwritten on a rolling cycle. A deletion from the live site may take until the next backup rotation to disappear from every copy.

11. Security

We use technical and organisational measures matched to a digital bookshop that holds both customer accounts and unpublished writing. That includes encrypted transport (HTTPS), hashed passwords, access limited to people who need it, separation of paid ebook files from the public web root, and rate limits on tools such as Find a book and sign-in.

No online service is invulnerable. You must keep your password to yourself and use a unique one. If you think an account was used without you, tell us at once so we can lock it and review downloads.

If a personal-data breach is likely to result in a high risk to you, we will tell you and, where the law requires, the ICO, without undue delay.

12. Your rights

Subject to the exemptions in UK GDPR and the Data Protection Act 2018, you may:

• Access — ask whether we process your data and receive a copy.
• Rectify — correct inaccurate data; complete data that is incomplete.
• Erase — ask us to delete data where the law allows (we may retain invoices or files we must keep).
• Restrict — ask us to store but not use data while a challenge is resolved.
• Port — receive data you provided, where processing is automated and based on consent or contract, in a commonly used machine-readable form.
• Object — object to processing based on legitimate interests, including profiling of that kind; object at any time to direct marketing, which we will stop.
• Withdraw consent — where consent was the basis, without affecting earlier lawful use.
• Complain — to us first, then to the ICO (see section 14).

We do not use solely automated decisions that produce legal or similarly significant effects about you (UK GDPR Art. 22), such as a machine refusing an author application with no human review.

To exercise a right, email hello@bookwritting.com from the address on your account, or use Contact, and say which right you mean. We may need to confirm it is you. We respond within one month of a complete request, or we will tell you if the law allows a further two months for a complex or numerous request. The first copy of your data is free; we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.

13. International transfers

Our primary operations are in the United Kingdom. Some processors (for example payment, email or infrastructure firms) may store or view data in the European Economic Area, the United States or another country.

When we transfer personal data outside the UK, we use a mechanism recognised by UK law — typically the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, or a UK adequacy regulation — and we assess the destination where that is required. You may ask us for a summary of the safeguards that apply to a named transfer.

14. The Information Commissioner

You can complain to the UK Information Commissioner’s Office if you are unhappy with how we handle your data.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113

If you live in the EEA you may also contact your local supervisory authority. We would rather put a problem right ourselves first; please write to us so we have that chance.

15. Cookies and similar tools

Essential cookies make the cart, sign-in and security features work. Optional cookies, if we use them, are described in the Cookie Policy and can be refused without losing the core store, though some remembering of preference may stop.

16. Public literary spaces

Book Clubs, short stories, events and member pages are meant to be read by other people. Do not post addresses, school names, medical details or anyone else’s private life. We may remove or restrict content that breaks the law, the User Agreement, or another person’s rights, and we may keep a record of that action.

Search engines may index public pages. Taking a post down on Book Writting does not remove copies that others have already made.

17. Authors, ghostwriting and moral rights in the file

Owning copyright in a text is not the same as controlling every copy of personal data inside our systems. Even where you remain the author of a work, we may keep production files, invoices and correspondence as set out in section 10. Deleting an author account does not, by itself, un-publish a title already sold to readers or remove it from their My books library.

If a published ebook must be withdrawn for a legal reason (defamation, privacy, copyright), contact us with the title, ISBN if any, and the reason. We will consider takedown of the public listing. Purchasers who already downloaded a lawful copy are a separate matter, as with any bookshop.

18. Changes

Publishing, payments and the law move. We will revise this Policy when the business sees fit. The version on this page is the current one. Material changes will be reflected here; if a change needs a new consent, we will ask for it.

19. How to reach us

Book Writting Ltd
37 McDougall Road, Wednesbury, England, WS10 0TH
hello@bookwritting.com
bookwritting.com/contact

Related documents: Privacy Policy · Cookie Policy · Refunds & Returns · Terms