OUR PRIVACY POLICY

The data controller responsible for your personal information is:

Legal business name: THE WORST BOOK COMPANY
Trading name: The Worst Book Company
Business address: 124 City Road, London, England, EC1V
Email: hello @ theworstbook.com

If you have any questions about how we use your personal information, please contact us using the details above.

Depending on how you interact with us, we may collect:

• your name;

• billing and delivery address;

• email address;

• telephone number, where you provide it;

• details of products you purchase;

• order and transaction information;

• correspondence you have with us;

• information you provide when contacting us;

• your email marketing preferences;

• information about how you interact with our emails, where our email marketing platform provides this information;

• technical information about your use of our website, such as IP address, browser type and device information, where applicable;

• information collected through cookies and similar technologies, subject to your cookie preferences.

We do not need your payment card number or security code. Payments are processed by our payment provider.

We use personal information for the following purposes:

Processing and fulfilling orders

We use your name, contact details, delivery address and order information to:

• process your purchase;

• take payment;

• prepare and dispatch your order;

• communicate with you about your order;

• deal with returns, refunds and customer service enquiries;

• keep appropriate records of transactions.

The lawful basis for this processing is that it is necessary to perform our contract with you and, where applicable, to comply with our legal obligations.

Customer service

We may use information you provide when you contact us to respond to enquiries, resolve problems and provide customer support.

The lawful basis will normally be performance of our contract with you, compliance with legal obligations, or our legitimate interests in providing and improving customer service.

Legal and business administration

We may use personal information where necessary to comply with legal, accounting, tax, regulatory or insurance requirements and to establish, exercise or defend legal claims.

Email marketing

If you choose to join our email list, we may use your name and email address to send you marketing emails about The Worst Book Company, including products, stories, experiences, news and other updates.

Our email marketing platform is Kit.

Where consent is required, we rely on your consent to send marketing communications.

You can unsubscribe from marketing emails at any time by using the unsubscribe link included in our emails or by contacting us.

You have an absolute right to object to direct marketing.

Unsubscribing from marketing emails does not stop us sending essential service communications relating to an order you have placed.

Depending on what we are doing with your information, we may rely on one or more of the following lawful bases:

Contract: where we need your information to enter into or perform a contract with you, such as processing an order.

Legal obligation: where we need to use your information to comply with a legal requirement.

Consent: where you have freely given permission for us to use your information for a particular purpose, such as certain marketing or non-essential cookies.

Legitimate interests: where we have a legitimate business reason for using information and this is not overridden by your rights and interests.

Where we rely on consent, you can withdraw that consent at any time. Withdrawal does not affect processing that took place before you withdrew consent.

We only share personal information where necessary for the purposes described in this Privacy Policy.

Depending on how you interact with us, this may include:

Website provider

Our website is hosted and operated using Squarespace.

Squarespace may process information on our behalf as part of providing website, ecommerce, hosting, security and related services.

Payment provider

Payments are processed through the payment provider offered at checkout, such as Stripe.

Your payment information is processed by the relevant payment provider in accordance with its own privacy information and security practices.

Email marketing provider

We use Kit to manage our email list and send marketing emails.

Kit may process your name, email address, subscription status and information relating to your interaction with our emails.

Delivery providers

We may share your name, delivery address and necessary contact information with postal or courier providers so that your order can be delivered.

Professional and legal advisers

Where necessary, we may share information with professional advisers, accountants, insurers, lawyers, regulators, law enforcement authorities or other organisations where we are legally required or entitled to do so.

We do not sell your personal information.

As we use third-party service providers to help run our business, the personal data we collect from you may be transferred to, stored at, and processed in destinations outside the United Kingdom (UK - primarily in the United States.

Specifically, your data is transferred to the following US-headquartered platforms:

• Squarespace (for website hosting, security, and visitor analytics)

• Kit (for managing subscriber lists and sending email marketing campaigns)

• Stripe (for secure payment processing and handling transactional data)

• Google (for our business email communications and productivity software)

To ensure your personal data receives a level of protection equivalent to that guaranteed under the UK GDPR, we only transfer data to overseas providers who have robust legal safeguards in place. For the providers listed above, we rely on the following approved mechanisms:

• The UK Extension to the EU-U.S. Data Privacy Framework: This is a UK-government-approved framework ensuring certified US companies maintain strict data protection standards. Our providers (including Squarespace, Google, and Stripe) participate in this framework.

• Standard Contractual Clauses (SCCs) & UK International Data Transfer Addendums: These are legally binding, standard data protection contracts embedded into our agreements with these providers, requiring them to protect your data to UK standards.

If you would like further information on specific safeguards utilised for any of these transfers, please contact us at hello @ theworstbook.com

We will only retain your personal data for as long as reasonably necessary for the purposes for which it was collected, including for the purpose of satisfying any legal, regulatory, tax, accounting, or reporting requirements.

To determine the appropriate retention period, we look at the nature and sensitivity of the data, the potential risk of harm from unauthorised use, and applicable legal obligations. In practice, we apply the following retention periods:

• Customer & Transactional Data (Stripe & Squarespace): If you purchase a product or service from us, we retain your transactional and billing records for 6 years following the end of the current financial tax year. This is a strict legal requirement under UK tax law (HMRC)

• General Correspondence (Google Workspace): We retain standard business emails and enquiries for up to 2 years after our last interaction with you, unless they relate to an ongoing contract or legal matter requiring a longer retention period.

• Email Marketing Subscribers (Kit): We retain your name and email address for as long as you choose to remain subscribed to our mailing list. If you opt out or unsubscribe, your details will be marked as inactive and securely deleted or anonymised within 30 days. This is subject to any information we need to retain for legal or administrative purposes.

When personal data is no longer required, we will securely delete it, securely destroy it, or anonymise it so that it can no longer be associated with you.

Under UK data protection law, you have specific rights regarding your personal information. Depending on the circumstances, you can exercise the following rights:

• Right of Access You can request a copy of the personal data we hold about you (commonly known as a “Data Subject Access Request”).

• Right to Rectification: You can ask us to correct any incomplete or inaccurate information we hold about you.

• Right to Erasure: You can ask us to delete or remove your personal data when there is no compelling reason for us to continue processing it (subject to exceptions, such as UK tax retention laws for financial records).

• Right to Restrict or Object to Processing: You can object to us processing your data for direct marketing (such as unsubscribing from our Kit newsletters) or ask us to temporarily suspend processing.

• Right to Data Portability; You can request that we transfer your data to you or a third-party in a structures, machine-readable format.

• Right to Withdraw Consent: If we rely on your consent to process data (such as analytics cookies or marketing emails), you can withdraw that consent at any time.

If you wish to exercise any of these rights, please contact us at hello @ theworstbook.com . We do not charge a fee to respond to your request and will aim to respond within one month.

You can unsubscribe from our marketing emails at any time by clicking the unsubscribe link in the email.

You can also contact us directly to ask us to stop sending marketing communications.

We will respect your marketing preferences.

Our website uses cookies and similar technologies.

Some cookies are necessary for the website to operate, including functions such as security, shopping baskets and checkout.

Other cookies may be used for purposes such as analytics, remembering preferences or other non-essential functions.

Where required by law, we will ask for your consent before placing or using non-essential cookies or similar technologies.

You can manage your cookie preferences through the cookie settings available on our website.

Our cookie information should be read alongside this Privacy Policy.

When you visit our website, we use a built-in third-party analytics service, Squarespace Analytics, to collect information about how you interact with our site. This data helps us understand website traffic, monitor site performance, and improve our services.

• What We Collect: The analytics data collected may include your IP address, your approximate geographic location, your browser type, your operating system, the pages you visit on our site, and how you navigated to us.

• How We Use Cookies: Squarespace Analytics utilises non-essential performance and analytics cookies to track visitor behaviour over time.

• Legal Basis for Processing: We only activate analytics cookies and collect tracking data if you give us your explicit consent via our website’s cookie banner. The legal basis for this processing is your consent.

• How to Opt-Out: You can decline analytics tracking at any time by selecting “Decline” on our website’s cookie banner, or by adjusting your web browser settings to block all cookies.

• For more information on how Squarespace handles this data you can review the Squarespace Privacy Policy.

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, alteration or disclosure. To keep your data secure, we use industry-standard safeguards, which include:

• Encryption: Protecting transactional data and communications using secure socket layer (SSL) or transport layer security (TLS) technology.

• Access Controls: Restricting access to your personal data solely to employees, contractors, and trusted service providers who have a legitimate business need to know.

• Provider Security: Partnering only with reputable third-party platforms (like Squarespace, Stripe, Google, and Kit) that maintain robust, certified security infrastructures.

However, please be aware that no method of transmitting or storing information online can be guaranteed to be completely secure. While we do our utmost to protect your personal data, we cannot guarantee the absolute security of data transmitted to or from our website.

Our website and products are not specifically directed at children.

We do not knowingly collect personal information from children for marketing purposes.

If you believe that a child has provided us with personal information inappropriately, please contact us so that we can investigate and take appropriate action.

We may update this Privacy Policy from time to time to reflect changes in our business, technology, services or legal requirements.

The latest version will always be available on our website.

Where appropriate, we will bring significant changes to your attention.

If you have concerns or questions about how we use your personal data, please contact us directly at hello @ theworstbook.com so we can resolve the issue for you.

You also have the right to lodge a formal complaint at any time with the UK’s supervisory authority for data protection:

• The Information Commissioner’s Office (ICO)

• Website: https://ico.org.uk

• Helpline: 03031231113