Privacy policy

This policy explains how Proudly Bookish collects and uses your personal information when you visit our website, buy from us online or at our market stall, come to our events, sign up to our newsletter or get in touch.

1. Who we are

Proudly Bookish Ltd (company number 16041621, registered office 14 Springfield Garden, Stokesley, North Yorkshire, TS9 5PH) decides how your personal information is used and is responsible for it. We are registered with the Information Commissioner’s Office under number ZC270715.

We are a small, owner-run bookshop, and our director Philip looks after data protection, including any complaints about how we use your information. Contact us at proudly.bookish.uk@gmail.com, by phone on 07960 727393, or by post at the address above.

2. What we collect and why

Taking and delivering your orders

What: name, delivery and billing addresses, email, phone number, what you ordered, returned or cancelled.
Why we’re allowed: to carry out our contract with you.
How long: 6 years after the end of the financial year of your purchase, because tax law requires it.

Taking payment

What: your card details go straight to our payment providers. We see only the card type, the last four digits and whether the payment succeeded.
Why we’re allowed: to carry out our contract with you.
How long: as for orders.

Your account, if you create one

What: name, email, saved addresses, order history and any wishlist.
Why we’re allowed: to carry out our agreement with you to provide the account.
How long: until you close your account, or after 3 years without use.

Special orders, pre-orders and book enquiries

What: name, contact details, and the book you want or your description of it.
Why we’re allowed: to take steps you ask for before, or as part of, a contract.
How long: 12 months after our last contact, unless it becomes an order.

Event bookings

What: name, email and number of tickets. If you choose to tell us about access needs, we use them only to make arrangements for you.
Why we’re allowed: to carry out our contract with you; for access needs, your explicit consent.
How long: 12 months after the event; access needs are deleted after the event.

Answering questions and complaints

What: your messages and our replies.
Why we’re allowed: our legitimate interest in resolving your query, and our legal duty to handle data protection complaints.
How long: 2 years after the matter is closed.

Reviews

What: the name you post under and what you write.
Why we’re allowed: our legitimate interest in sharing customers’ views of our books.
How long: while the review is shown, or until you ask us to remove it.

Our email newsletter

What: name, email address, and which emails you open and links you click.
Why we’re allowed: your consent; or, if you have bought from us, our legitimate interest in telling you about similar books and events. You can opt out at any time.
How long: until you unsubscribe. We then keep your email address on a do-not-contact list so we don’t email you again.

Running the website safely and understanding how it is used

What: IP address, device and browser type, and pages visited.
Why we’re allowed: our legitimate interest in a secure, working website. Analytics cookies are used only with your consent (see section 8).
How long: as set in each tool, and no longer than 26 months.

Personalised advertising

What: your activity on our website, shared with advertising partners such as social media platforms so they can show you our adverts.
Why we’re allowed: your consent, given through our cookie banner. Without it, we don’t do this.
How long: until you withdraw consent.

Photographs at our events

What: images of people attending.
Why we’re allowed: our legitimate interest in promoting our events. We will always say at the event that photos are being taken, and we will not publish identifiable photos of children without a parent’s or carer’s consent.
How long: until you ask us to remove them, or 3 years.

Preventing fraud and meeting legal duties

What: order, payment and device information.
Why we’re allowed: our legitimate interest in preventing fraud, and our legal obligations.
How long: as for orders.

We do not sell your information. We do not make decisions about you by purely automated means that have legal or similarly significant effects.

3. Where we get it from

Most of it comes directly from you. Some is collected automatically when you use our website, through cookies. Some comes from our service providers, for example confirmation from our payment provider that a payment succeeded, or delivery updates from a courier.

4. Who we share it with

We share only what each organisation needs to do its job, and each works on our instructions under a contract that protects your information.

Shopify: runs our website, checkout and customer records.
Our payment providers: Shopify Payments online, and SumUp for card payments at our stall.
Gardners, our book wholesaler: receives your name and delivery address when it sends an order directly to you.
Royal Mail and other couriers: deliver your parcel.
Xero, Monzo and our accountant: for bookkeeping, banking and tax.
Mailchimp: sends our newsletter and holds our mailing list.
Advertising partners: only if you consent to marketing cookies.
HMRC, the police or other authorities: only where the law requires us to.
A buyer of our business: if we ever sell it, in which case your information would stay protected as described here.

5. Shopify’s own use of information

Shopify also uses some information from your visits to Shopify stores, including ours, for its own purposes, such as fraud protection and features like Shop Pay. For that use, Shopify is responsible, not us. You can read how Shopify handles your information, and exercise your rights with Shopify, at privacy.shopify.com.

6. Transfers outside the UK

Some of our providers, including Shopify and Mailchimp, hold information outside the UK. When they do, we make sure it is protected to UK standards, relying either on UK government regulations recognising the destination as adequate, or on contract terms approved by the Information Commissioner.

7. Our newsletter and marketing

We email you only if you have signed up, or if you have bought from us and did not opt out when you did. Every email has a one-click unsubscribe link, and you can also email us to stop. We do not send marketing by text message or post unless you have asked us to.

8. Cookies

Cookies are small files stored on your device when you visit a website.

Essential cookies keep your basket, checkout and account working and the site secure. They don’t need your consent.
Analytics cookies help us count visits and see which pages are useful. We set them only if you agree in our cookie banner.
Marketing cookies, for example from social media or advertising platforms, are set only if you agree in our cookie banner.

You can change your choices at any time using the cookie settings link at the bottom of every page.

9. Children

Our website is for adults to buy from, and we do not knowingly collect information online from children under 13. Children’s event places are booked by a parent or carer. If you think a child has given us their information, contact us and we will delete it.

10. Keeping your information safe

We use two-factor sign-in on our business systems and limit access to the people who need it. No system is perfectly secure, so please don’t email us card details or other sensitive information. If a security breach puts your information at risk, we will tell you and the Information Commissioner where the law requires.

11. Your rights

You have the right to:

ask for a copy of the information we hold about you;
ask us to correct it;
ask us to delete it, or to restrict how we use it;
object to how we use it, and stop direct marketing at any time;
receive information you gave us in a format you can pass to someone else;
withdraw your consent where we rely on it.

Contact proudly.bookish.uk@gmail.com. There is no charge. We may need to confirm your identity first, and someone else can make a request for you if they show us your authority. We will respond within one month, or tell you within that month if a complex request needs up to two months more.

12. How to complain

Please tell us first if you are unhappy with how we have handled your information, at proudly.bookish.uk@gmail.com or by post to the address in section 1. Philip will handle your complaint, and you don’t need to use any particular form of words. We will acknowledge your complaint within 30 days (we aim for 5 working days), look into it, keep you updated, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

13. Changes to this policy

We will update this policy when what we do changes, and show the date at the top.