1. Who We Are (Data Controller)
Ashtead Press is a trading name and publishing imprint of Yellow Consulting Limited, a private limited company incorporated and registered in England and Wales under Company Registration Number 03441564.
For the purposes of the UK GDPR and the Data Protection Act 2018, Yellow Consulting Limited is the Data Controller. You can contact us regarding any privacy, data protection, or subject access enquiry via our Contact Us page or directly by email at enquiries@ashteadpress.co.uk.
2. What Information We Collect & Why
As a non-transactional publisher website, we keep data collection to an absolute minimum in accordance with data minimisation principles. We collect and process personal data only for the following legitimate purposes:
- Enquiries and General Correspondence. When you contact us via email or through our Contact Us page regarding reader queries, editorial questions, or publishing matters, we collect your name, email address, and the contents of your message to evaluate and respond to your enquiry.
- Trade, Rights & Commercial Licensing. When booksellers, wholesalers, literary agents, or rights buyers contact us regarding wholesale ordering, co-editions, translation rights, or dramatic adaptations, we collect your name, business contact details, company affiliation, and commercial details necessary to administer trade relationships.
- Review Copies & Physical Postal Dispatch. When accredited literary reviewers, journalists, librarians, or booksellers request physical Advance Reading Copies (ARCs), proof copies, or press packs, we collect the recipient’s name, publication or organisational affiliation, and physical postal delivery address to dispatch physical copies.
- Unsolicited Manuscripts & Author Submissions. Ashtead Press operates a strict policy of not accepting unsolicited manuscript submissions, sample chapters, synopses, or illustration portfolios. Any unsolicited materials received via email or post are deleted or destroyed immediately without review or acknowledgement, and we do not store, catalogue, or process author personal data contained within unsolicited pitches.
- Technical Server Connection Logs. When you access this website, our hosting infrastructure automatically processes standard technical connection records, including your Internet Protocol (IP) address, browser user-agent string, HTTP request headers, and access timestamps to ensure network security and prevent malicious activity.
3. Lawful Bases for Processing
Under Article 6 of the UK GDPR, we process personal data under the following lawful bases:
- Legitimate Interests (Art. 6(1)(f)). Communicating with readers and trade contacts, assessing ARC and press requests, maintaining network and cybersecurity, preventing fraud, and administering general business correspondence.
- Contractual Necessity (Art. 6(1)(b)). Taking steps at your request prior to entering into a contract, or fulfilling contractual commitments relating to trade terms, rights licensing agreements, or requested material dispatches.
- Legal Obligation (Art. 6(1)(c)). Complying with statutory, tax, corporate reporting, and legal record-keeping requirements under UK law.
4. Data Retention Periods
In accordance with UK GDPR Article 13(2)(a), personal data is kept only for as long as necessary to fulfil the specific purposes for which it was collected, applying the following criteria and retention schedules:
- General Correspondence & Reader Enquiries: Retained for a maximum of 12 months following the resolution of your query, after which messages are securely deleted.
- Commercial, Trade & Rights Licensing Enquiries: Retained for 6 years from the conclusion of commercial dealings or contract expiry, in accordance with statutory limitation periods for breach of contract claims under the UK Limitation Act 1980.
- Review Copy Postal Records: Postal delivery addresses collected solely for dispatching physical review copies or proofs are retained for 12 months to verify delivery and resolve postal carrier queries, then purged.
- Unsolicited Manuscripts & Pitches: Any unsolicited creative manuscripts, proposals, or portfolio materials received are deleted or securely shredded immediately upon receipt and are not retained in our systems.
- Technical Server Logs: Maintained on a rolling retention window of 30 to 90 days for cybersecurity analysis, edge debugging, and DDoS defence, after which they are permanently purged or aggregated into anonymised statistics.
5. Third-Party Data Processors & Service Providers
Under UK GDPR Article 13(1)(e), we disclose the categories of third-party service providers who process personal data on our behalf as appointed Data Processors:
- Cloud Web Hosting & Infrastructure: Our static website hosting and content delivery infrastructure is provided by Google Cloud Platform / Firebase Hosting, which processes connection logs and serves web assets under robust data security standards.
- Business Email & Productivity Services: Electronic correspondence and enquiries are hosted and managed via enterprise cloud email and communication providers, providing encrypted transmission and secure storage.
- DNS, Security & DDoS Protection: Domain routing, SSL/TLS certificate termination, and DDoS mitigation services are managed through specialised network infrastructure and security providers.
- Postal Carriers & Couriers: For physical proof and ARC dispatches, recipient names and postal addresses are provided to courier services and postal carriers (including Royal Mail, ParcelForce, and international postal partners) solely to achieve physical delivery.
All third-party data processors are bound by written Data Processing Agreements (DPAs) pursuant to UK GDPR Article 28, obliging them to process personal data strictly on our documented instructions and maintain appropriate technical and organisational security measures.
6. International Data Transfers
Ashtead Press operates primarily within the United Kingdom. However, our third-party infrastructure, web hosting, and cloud email providers maintain global server facilities, which may involve routing or storing personal data outside the UK (including in the European Economic Area (EEA) and the United States).
Where personal data is transferred outside the UK, we ensure appropriate safeguards are maintained in compliance with UK GDPR Chapter V:
- Transfers to the EEA: Covered by UK Adequacy Regulations, confirming that the recipient territory provides an essentially equivalent level of data protection to that in the UK.
- Transfers to the United States & Third Countries: Carried out under the UK International Data Transfer Addendum (IDTA) to the European Commission's Standard Contractual Clauses (SCCs), or pursuant to the UK Extension to the EU-US Data Privacy Framework (DPF) where the recipient organisation maintains certified compliance.
7. Cookies & Tracking Technologies
This website uses only essential, functional cookies and local storage tokens (recording your acknowledgement of our cookie and privacy notice banner). We do not deploy third-party advertising cookies, behavioural profiling tools, or cross-site tracking pixels.
8. External Links & Retailers
Our website contains links directing you to external third-party retailers (such as Bookshop.org, Waterstones, Blackwell's, Foyles, Amazon, and Apple Books). When you click on an external retailer link, you leave our website. Yellow Consulting Limited is not responsible for the privacy practices, content, or data processing of those external websites. We encourage you to review their respective privacy notices.
9. Your Statutory Rights Under UK GDPR
Under the UK GDPR and the Data Protection Act 2018, you possess specific legal rights regarding your personal information:
- Right of Access (Art. 15): You have the right to request confirmation as to whether we process your personal data and to receive a copy of that data.
- Right to Rectification (Art. 16): You may request that inaccurate or incomplete information be updated or corrected.
- Right to Erasure (Art. 17): You may request the deletion of your personal data where retention is no longer legally justified.
- Right to Restrict Processing (Art. 18): You may request that we suspend processing your data in certain circumstances.
- Right to Data Portability (Art. 20): Where technically feasible, you have the right to request the transfer of your personal data directly to you or another controller in a structured, commonly used, and machine-readable format.
- Right to Object (Art. 21): You have the right to object to processing based on our legitimate interests.
To exercise any of these rights, please contact us via our Contact Us page or email enquiries@ashteadpress.co.uk. We respond to all verified requests within one calendar month, free of charge.
If you have concerns about how your data has been handled, you have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner’s Office (ICO) at ico.org.uk or by telephone on 0303 123 1113.