Privacy Policy
At Buy the Book Ltd, we are committed to protecting your privacy. This policy outlines how we handle your personal information.
Buy The Book Ltd
Company Registration Number: 07476241
Registered Office: 52 William Street, Carshalton, Surrey, SM5 2RB, United Kingdom
Website: www.buythebookltd.co.uk
Email: info@buythebookltd.co.uk
Last updated: 18 August 2026
1. Introduction
Buy The Book Ltd ("Buy The Book", "we", "us" or "our") respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you:
-
visit or use our website;
-
create an account with us;
-
purchase books or other products from us;
-
contact us by email, telephone, social media or through our website;
-
subscribe to marketing communications;
-
enter a promotion, competition or survey;
-
interact with us through a third-party marketplace or platform; or
-
otherwise engage with Buy The Book Ltd.
It also explains your rights in relation to your personal information and how you can exercise those rights.
For the purposes of UK data protection legislation, Buy The Book Ltd is the Data Controller in respect of the personal information covered by this Privacy Policy.
2. Data Protection Legislation
We process personal information in accordance with applicable UK data protection and privacy legislation, including, where relevant:
-
the UK General Data Protection Regulation (UK GDPR);
-
the Data Protection Act 2018;
-
the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended;
-
the Data (Use and Access) Act 2025, including amendments it has made to UK data protection and electronic communications legislation; and
-
any other applicable legislation, regulations or statutory guidance relating to privacy, electronic communications and the processing of personal information.
We also have regard to relevant guidance and codes of practice issued by the Information Commissioner's Office (ICO).
3. The Data Protection Principles
When processing personal information, we aim to ensure that it is:
-
processed lawfully, fairly and transparently;
-
collected for specified, explicit and legitimate purposes;
-
adequate, relevant and limited to what is necessary;
-
accurate and, where necessary, kept up to date;
-
retained for no longer than necessary;
-
processed securely and protected against unauthorised or unlawful processing, accidental loss, destruction or damage; and
-
handled in a manner that enables us to demonstrate compliance with our legal obligations.
4. Information We May Collect
Depending upon how you interact with us, we may collect and process the following categories of personal information.
Identity information
This may include:
-
name;
-
title;
-
username or account identifier; and
-
other information you provide when creating an account or placing an order.
Contact information
This may include:
-
billing address;
-
delivery address;
-
email address;
-
telephone number; and
-
other contact information you choose to provide.
Transaction and order information
This may include:
-
products purchased;
-
order numbers;
-
transaction dates;
-
purchase history;
-
delivery information;
-
refunds and returns;
-
discounts or promotional codes used; and
-
correspondence concerning an order.
Payment information
When you make a purchase, payment information may be processed by us and/or by the payment service provider used to process the transaction.
Depending on the payment method used, this may include information required to authorise and process your payment.
Where payment processing is undertaken directly by a third-party payment provider, that provider may process your payment information in accordance with its own privacy policy and security arrangements.
Technical information
When you use our website, information may be collected automatically, including:
-
IP address;
-
browser type and version;
-
device type;
-
operating system;
-
time zone;
-
website activity;
-
pages visited;
-
referring website;
-
approximate geographical information derived from an IP address; and
-
cookie identifiers and similar technical information.
Communications information
We may retain information contained within communications you have with us, including:
-
emails;
-
website enquiries;
-
customer service enquiries;
-
complaints;
-
social media communications; and
-
correspondence relating to orders, refunds or returns.
Marketing information
This may include:
-
your marketing preferences;
-
whether you have subscribed or unsubscribed;
-
your interaction with marketing communications; and
-
your communication preferences.
5. How We Collect Your Information
We may collect personal information:
Directly from you
For example, when you:
-
place an order;
-
create an account;
-
contact us;
-
subscribe to a newsletter;
-
request information;
-
submit a review or enquiry;
-
participate in a survey or promotion; or
-
otherwise provide information to us.
Automatically
Certain technical information may be collected automatically when you visit our website through cookies, server logs and similar technologies.
From third parties
We may receive personal information from third parties where appropriate, including:
-
payment processors;
-
online marketplaces;
-
delivery and fulfilment providers;
-
website and e-commerce service providers;
-
analytics providers;
-
marketing platforms;
-
social media platforms; and
-
fraud prevention or security services.
Where we obtain personal information from another source, we will process it in accordance with applicable data protection legislation.
6. How and Why We Use Personal Information
We will only process personal information where we have a lawful basis for doing so.
Our principal purposes and lawful bases may include:
Processing and fulfilling orders
We use information to:
-
process purchases;
-
take or arrange payment;
-
confirm orders;
-
prepare and dispatch products;
-
provide delivery information;
-
manage returns and refunds; and
-
communicate with customers concerning their orders.
Lawful basis: Performance of a contract or taking steps at your request before entering into a contract.
Customer service
We may process information to:
-
answer enquiries;
-
provide customer support;
-
investigate problems;
-
deal with complaints; and
-
resolve disputes.
Lawful basis: Performance of a contract and/or our legitimate interests in operating our business and providing effective customer service.
Accounting, taxation and legal compliance
We may retain and process transaction information where necessary to comply with legal, taxation, accounting and regulatory requirements.
Lawful basis: Compliance with a legal obligation.
Fraud prevention and security
We may process information to:
-
protect our website;
-
prevent fraudulent transactions;
-
investigate suspicious activity;
-
maintain information security; and
-
protect Buy The Book Ltd, our customers and third parties.
Lawful basis: Legitimate interests and, where applicable, compliance with a legal obligation.
Website administration and improvement
We may use information to understand how our website is used, maintain website functionality and improve our services.
Lawful basis: Legitimate interests and/or consent where consent is required for cookies or similar technologies.
Marketing
Where permitted by law, we may use your contact details to tell you about products, promotions, offers or news that we believe may be of interest.
Lawful basis: Consent or legitimate interests, as appropriate and subject to the requirements of PECR.
You can opt out of direct marketing at any time.
7. Legitimate Interests
Where we rely upon legitimate interests as our lawful basis, those interests may include:
-
operating and developing our business;
-
providing effective customer service;
-
protecting our business against fraud;
-
maintaining website and information security;
-
understanding customer behaviour;
-
improving our products and services;
-
managing our relationship with customers; and
-
promoting our products where legally permitted.
Where we rely upon legitimate interests, we consider whether our interests are proportionate and whether they are overridden by the rights and interests of the individual concerned.
8. Marketing Communications
We may send marketing communications by email or other electronic means where permitted by law.
Where PECR requires consent, we will seek appropriate consent before sending electronic marketing.
In certain circumstances, we may be permitted to contact existing customers about our own similar products or services where the applicable legal requirements are satisfied.
Every electronic marketing communication will provide an appropriate method for opting out or unsubscribing.
You can also ask us to stop sending marketing communications at any time by contacting:
Opting out of marketing will not prevent us from sending necessary service communications relating to an existing order, account, transaction or legal matter.
We may retain limited information about people who have opted out in a suppression list to ensure that we respect their preferences in the future.
9. Cookies and Similar Technologies
Our website may use cookies and similar technologies.
Cookies are small files or pieces of information stored on or accessed from your device.
Cookies may be used for purposes including:
-
enabling essential website functions;
-
maintaining shopping baskets;
-
remembering preferences;
-
website security;
-
analysing website usage;
-
measuring website performance; and
-
advertising or marketing, where applicable.
Some cookies are strictly necessary for the operation of the website and may not require consent.
Where consent is legally required for non-essential cookies or similar technologies, we will request consent before those technologies are used.
You should be provided with appropriate controls to accept, reject or manage non-essential cookies.
Further information about the cookies used on our website should be provided through our cookie notice or cookie management tool.
10. Sharing Personal Information
We do not sell personal information.
We may share personal information where necessary with trusted third parties that assist us in operating our business, including:
-
payment processors;
-
banks and financial institutions;
-
postal, courier and delivery companies;
-
fulfilment providers;
-
website hosting providers;
-
e-commerce platforms;
-
IT and technical support providers;
-
email and communications providers;
-
accountants and professional advisers;
-
analytics providers;
-
marketing service providers;
-
fraud prevention and cybersecurity providers; and
-
government bodies, regulators, law enforcement agencies or courts where required by law.
Third-party service providers processing information on our behalf are required to process that information appropriately and subject to applicable data protection requirements.
We may also disclose personal information where necessary to establish, exercise or defend legal claims or protect the rights, property or safety of Buy The Book Ltd, our customers or others.
11. Business Transfers
If Buy The Book Ltd is involved in a merger, acquisition, restructuring, sale of assets or transfer of all or part of the business, personal information may be disclosed to prospective purchasers, professional advisers or other relevant parties where lawful and necessary.
Any subsequent processing of personal information will remain subject to applicable data protection legislation.
12. International Transfers
Some organisations providing services to us may process or store information outside the United Kingdom.
Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer complies with UK data protection legislation.
Depending upon the destination and circumstances, safeguards may include:
-
UK adequacy regulations;
-
legally recognised contractual safeguards;
-
the UK International Data Transfer Agreement;
-
the UK Addendum to approved Standard Contractual Clauses; or
-
another transfer mechanism permitted by UK data protection legislation.
You may contact us if you would like further information about safeguards applying to international transfers of your personal information.
13. Data Security
We take appropriate technical and organisational measures designed to protect personal information against:
-
unauthorised access;
-
unlawful processing;
-
accidental loss;
-
alteration;
-
disclosure;
-
destruction; or
-
damage.
Measures may include appropriate access controls, passwords, technical security measures, staff procedures, secure systems and restrictions on access to personal information.
Access to personal information is limited to individuals and organisations that have a legitimate need to access it.
No internet-based system can, however, be guaranteed to be completely secure.
14. Personal Data Breaches
We maintain procedures for identifying, investigating and responding to personal data breaches.
Where a personal data breach is likely to result in a risk to people's rights and freedoms, we will notify the Information Commissioner's Office where required by law.
Where a breach is likely to result in a high risk to an affected individual's rights and freedoms, we will also inform that individual where required.
15. How Long We Keep Personal Information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including satisfying legal, regulatory, taxation, accounting and reporting requirements.
Different categories of information may therefore have different retention periods.
For example, records relating to purchases and financial transactions may need to be retained for a number of years in order to comply with taxation, accounting and legal requirements.
When determining appropriate retention periods, we consider:
-
the nature and sensitivity of the information;
-
the purpose for which it is held;
-
the amount of information involved;
-
applicable legal and regulatory requirements;
-
potential legal claims;
-
security considerations; and
-
whether the information can be securely deleted or anonymised.
When information is no longer required, we will take reasonable steps to securely delete, destroy or anonymise it.
16. Children's Personal Information
Buy The Book Ltd specialises in books and products that may be intended for children. However, our retail website and purchasing services are generally intended to be used by adults, including parents, carers, teachers and other persons purchasing products for children.
We do not knowingly seek to collect unnecessary personal information directly from children.
We encourage parents and guardians to supervise children's use of websites and online services.
If you believe that a child has provided personal information to us in circumstances where this should not have occurred, please contact:
We will investigate and, where appropriate, delete or otherwise appropriately handle the information.
17. Your Data Protection Rights
Depending upon the circumstances and the lawful basis on which your information is processed, UK data protection law provides you with a number of rights.
These may include:
Right of access
You may request confirmation that we process your personal information and request a copy of the personal information we hold about you.
This is commonly known as a Subject Access Request (SAR).
Right to rectification
You may ask us to correct personal information that is inaccurate or complete information that is incomplete.
Right to erasure
In certain circumstances, you may ask us to delete personal information.
This right is not absolute, and we may need to retain information where there is a lawful reason or legal obligation to do so.
Right to restriction of processing
In certain circumstances, you may ask us to restrict the way we process your personal information.
Right to data portability
In certain circumstances, you may have the right to receive personal information you have provided to us in a structured, commonly used and machine-readable format and/or ask for it to be transferred to another organisation.
Right to object
You may have the right to object to processing based upon legitimate interests.
You have an absolute right to object to the use of your personal information for direct marketing purposes.
Rights relating to automated decision-making
You may have rights relating to decisions based solely upon automated processing, including profiling, where those decisions produce legal or similarly significant effects.
Right to withdraw consent
Where we rely upon your consent, you may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn.
18. Exercising Your Rights
To exercise your data protection rights, please contact:
Buy The Book Ltd
52 William Street
Carshalton
Surrey
SM5 2RB
United Kingdom
Email: info@buythebookltd.co.uk
We will respond to valid requests within the timeframe required by applicable data protection legislation.
We will not normally charge a fee for exercising your data protection rights. However, the law permits fees or other appropriate action in certain circumstances, including where requests are manifestly unfounded or excessive.
We may request information reasonably necessary to confirm your identity before disclosing personal information.
19. Automated Decision-Making and Profiling
We do not intend to make decisions about individuals based solely upon automated processing that produce legal or similarly significant effects unless permitted by applicable law and appropriate safeguards are in place.
We may use limited automated processes for purposes such as fraud detection, website functionality, analytics or marketing personalisation.
Where the law requires additional information or safeguards concerning automated decision-making, we will provide them.
20. Third-Party Websites
Our website may contain links to websites operated by third parties.
Buy The Book Ltd is not responsible for the privacy practices, security or content of third-party websites.
If you follow a link to another website, you should review that organisation's privacy policy before providing personal information.
21. Social Media
We may operate accounts or pages on social media platforms.
When you communicate with us through a social media platform, both Buy The Book Ltd and the relevant platform may process information relating to that interaction.
Your use of a social media platform is also governed by the privacy terms and policies of that platform.
22. Online Marketplaces
Buy The Book Ltd may sell products through third-party online marketplaces in addition to our own website.
Where you purchase from us through a third-party marketplace, that marketplace may separately collect and process your personal information as an independent data controller.
We may receive information from the marketplace where necessary to fulfil your order, provide customer service, process a return or refund, maintain appropriate transaction records or comply with legal requirements.
You should also review the privacy policy of the marketplace through which you make your purchase.
23. Complaints
If you have concerns about how we use your personal information, we encourage you to contact us first so that we can investigate.
Please contact:
Buy The Book Ltd
52 William Street
Carshalton
Surrey
SM5 2RB
United Kingdom
Email: info@buythebookltd.co.uk
You also have the right to complain to the UK's independent data protection regulator, the Information Commissioner's Office (ICO).
Information about making a complaint and the ICO's current contact details are available through the ICO's official website.
Making a complaint to us does not affect your right to complain to the ICO.
24. Changes to this Privacy Policy
We may amend this Privacy Policy from time to time to reflect:
-
changes to our business;
-
changes to our website or services;
-
changes to the way we process personal information;
-
changes in technology;
-
changes to third-party services; or
-
changes in legislation, regulation or regulatory guidance.
The latest version will be made available through our website.
Where changes materially affect how we use personal information, we will take appropriate steps to bring those changes to the attention of affected individuals where required.
25. Contact Us
Questions about this Privacy Policy, our use of personal information or your data protection rights should be directed to:
Buy The Book Ltd
Registered Office:
52 William Street
Carshalton
Surrey
SM5 2RB
United Kingdom
Company Registration Number: 07476241
Website: www.buythebookltd.co.uk
Email: info@buythebookltd.co.uk
© 2026 Buy The Book Ltd. All rights reserved.