Privacy Policy

This notice explains what personal data Birr Series Publications Limited collects about you, where we get it from, why we use it, who we share it with, how long we keep it and what rights you have. It covers this website and any order or enquiry you make with us. Please read it before you give us your details.

1. Who we are and how to contact us

Birr Series Publications Limited is the data controller for the personal data described in this notice. That means we decide why and how your data is used, and we are responsible for looking after it.

• Registered in England and Wales at Companies House, company number 17330857
• Registered office: 5 Brayford Square, London E1 0SG, United Kingdom
• Email for any data protection question or request: info@birrseriespublications.com
• We are registered with the Information Commissioner’s Office. Our registration number is [ICO REGISTRATION NUMBER].

We are a small business and are not required to appoint a Data Protection Officer. Data protection questions are handled by the company directors, who can be reached at the email address above. We are established in the United Kingdom, so we do not need to appoint a UK representative.

2. What personal data we collect, and where we get it

We collect all of the following directly from you — when you place an order, create an account, apply for wholesale pricing, or contact us. We do not buy personal data, and we do not collect it from third parties or public sources.

• Order details — your name, billing address, delivery address, email address and telephone number.
• Account details — your username, your password (which is stored encrypted and cannot be read by us) and your order history, if you choose to create an account.
• Wholesale and educational registration details — the name of your madrasah, maktab, institute or business, and the contact details you give us when you apply for trade pricing.
• Payment details — card payments are taken by Stripe. Your card number is entered directly into Stripe’s secure form and never reaches our systems; we see only the last four digits, the card type and whether the payment succeeded. If you pay by bank transfer, we see the name on the transfer and the payment reference.
• Messages you send us — the content of your emails and any attachments.
• Technical data — your IP address, browser type and the pages you visit, recorded in our server logs and by our website security software.

We do not collect special category data (such as health, religion or ethnicity), and we ask that you do not send it to us.

3. Why we use your data, and our lawful basis

Data protection law requires us to have a lawful basis for everything we do with your data. Ours are set out below.

• To take and fulfil your order — taking payment, packing and dispatching your books, issuing invoices, and dealing with returns or refunds.
  Lawful basis: performance of a contract with you.
• To manage your account — letting you sign in, see past orders, and, for trade customers, applying your approved wholesale pricing.
  Lawful basis: performance of a contract with you.
• To answer your enquiries — replying to emails and messages about our books or your order.
  Lawful basis: performance of a contract, or our legitimate interests where you are not yet a customer.
• To keep accounting and tax records — retaining invoices and transaction records for HM Revenue and Customs and Companies House.
  Lawful basis: legal obligation.
• To protect the website and prevent fraud — blocking malicious traffic, stopping fraudulent card use, and keeping the shop running.
  Lawful basis: legitimate interests.
• To send marketing emails — news about new titles, bundles and offers.
  Lawful basis: your consent.

What our legitimate interests are

Where we rely on legitimate interests, those interests are: running a secure online shop that is not defrauded or taken offline by attackers; keeping accurate business records; and responding helpfully to people who contact us. We have considered whether this use could harm you, and we believe it does not, because it involves only limited data and is what a customer would reasonably expect a shop to do. You can object to any of this — see section 10.

4. Do you have to give us your data?

You are not required by law to give us any personal data. However, your name, delivery address, email address and payment details are needed under our contract with you: without them we cannot accept or deliver an order. If you do not wish to provide them, you can still browse the site, but you will not be able to buy from us.

Creating an account, giving a telephone number and signing up for marketing emails are all optional. Refusing them will not affect your order.

5. Cookies

Cookies are small text files placed on your device. No cookies are set when you simply browse this website. They are only used once you do something that needs them:

• Basket and checkout cookies (set by WooCommerce) — remember what is in your basket and carry it through to checkout.
• Sign-in cookies (set by WordPress) — keep you logged in to your account between pages.
• Payment and fraud-prevention cookies (set by Stripe) — confirm that a payment is genuine and not fraudulent.
• Security cookies (set by Wordfence) — help identify and block attacks on the site.

All of these are strictly necessary for the parts of the site you have asked to use, so the law does not require us to ask your consent for them. We do not use advertising cookies, and we do not use analytics that track you across other websites. If that ever changes, we will update this notice and ask for your consent before setting any non-essential cookie.

You can block or delete cookies in your browser settings, but if you do, the basket, sign-in and checkout will not work.

6. Who we share your data with

We do not sell your personal data and we do not share it for anyone else’s marketing. We share it only with the organisations below, and only with what they need:

• Stripe Payments Europe Ltd — processes card payments and carries out fraud checks.
• Delivery companies — receive your name, address and, where needed, your phone number or email so they can deliver your parcel.
• Hostinger — hosts this website and its database.
• Defiant Inc. (Wordfence) — provides website security and processes IP addresses to block attacks.
• Our email provider — sends order confirmations, dispatch notices and, if you have opted in, marketing emails.
• Our accountant, and HM Revenue and Customs — receive transaction records where tax law requires it.

We may also disclose data if the law requires it, or to establish or defend legal claims.

7. Where your data is stored, and transfers outside the UK

Our website and database are hosted within the United Kingdom or the European Economic Area. Some of our suppliers, including Stripe and our security provider, may process limited data outside the UK.

Where data leaves the UK, we rely either on UK adequacy regulations, which recognise that the receiving country protects data to a standard similar to our own, or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply to any transfer by emailing info@birrseriespublications.com, and we will send them to you free of charge.

8. How long we keep your data

• Orders, invoices and payment records — six years from the end of the financial year they relate to, because company and tax law requires it.
• Account details — while your account is open. If you ask us to close it, we delete the account within one month, keeping only the order records above.
• Wholesale application details — while your trade account is active, and for one year after it is closed or an application is refused, so that we can explain our decision if you ask.
• Marketing consent records — until you withdraw consent, plus two years afterwards, so we can show we had permission and honoured your withdrawal.
• Emails and enquiries — two years from your last message, unless it relates to an order, in which case it is kept with the order record.
• Website security and server logs — up to twelve months.

When a retention period ends, we delete the data or permanently anonymise it.

9. Automated decision-making and profiling

We do not make any decision about you by automated means alone that has a legal or similarly significant effect on you. We do not profile customers, and we do not use your data to predict your behaviour or interests.

Stripe runs automated fraud checks on card payments, which can decline a transaction. If a payment of yours is declined and you believe that is wrong, email us and a person will look at it and can arrange another way for you to pay.

10. Your rights

You have the following rights over the personal data we hold about you. They are free to use, and we will respond within one month.

• Right of access — ask for a copy of the data we hold about you.
• Right to rectification — have inaccurate or incomplete data corrected.
• Right to erasure — ask us to delete your data where we no longer have a reason to keep it. We may have to keep order records for the tax period described above.
• Right to restrict processing — ask us to pause our use of your data while a concern is resolved.
• Right to data portability — receive the data you gave us in a machine-readable format, or have it sent to another provider.
• Right to withdraw consent — where we rely on your consent, withdraw it at any time. This does not affect anything we did before you withdrew it.

Your right to object

You have the right to object to our use of your personal data where we rely on legitimate interests, and you have an absolute right to object to your data being used for direct marketing. If you object to direct marketing we will stop immediately, with no questions asked. If you object to any other processing, we will stop unless we can show compelling legitimate grounds that override your rights, or we need the data for legal claims.

To exercise any right, including the right to object, email info@birrseriespublications.com. Please tell us which right you want to use so we can deal with it quickly. We may ask you to confirm your identity before we release personal data.

11. Marketing, and how to withdraw consent

We send marketing emails only to people who have asked to receive them. We will never add you to our list simply because you bought from us without asking you first.

Withdrawing your consent is as easy as giving it. Click the unsubscribe link at the bottom of any marketing email, or email us and we will remove you. We will act on your request straight away.

Withdrawing consent does not stop emails we must send to fulfil your order, such as order confirmations, dispatch notices and invoices.

12. Children’s data

Our books are written for children, but this website is meant for adults. We do not knowingly collect personal data from children, and orders should be placed by a parent, guardian, teacher or institution. If you believe a child has given us their details, email us and we will delete them.

13. Keeping your data secure

The whole website runs over an encrypted HTTPS connection. Card details are handled entirely by Stripe and never pass through our systems. Passwords are stored encrypted. We run a security firewall on the site, keep the software updated, and limit access to personal data to the people who need it to run the business.

If a data breach ever occurs that is likely to put your rights at risk, we will tell you without undue delay and report it to the ICO within 72 hours as the law requires.

14. How to complain

If you are unhappy with how we have used your data, please email info@birrseriespublications.com first. We would rather put it right ourselves.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection. You do not have to contact us first.

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15. Changes to this notice

We review this notice regularly and update it whenever our practices change. The date at the top shows when it was last changed. If we ever want to use your data for a new purpose, we will tell you about it, and give you the relevant information, before we start.

16. Contact us

Birr Series Publications Limited
5 Brayford Square, London E1 0SG, United Kingdom
Company number 17330857
info@birrseriespublications.com