1. Who we are
Orchestra Books Ltd is the controller of personal information collected through this website and through our publishing, bookselling, distribution and institutional services. Our registered office is 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom. You can contact us at contact@orchestrabooks.co.uk.
2. Information we collect
Depending on how you use the website, we may collect:
- identity and contact details, including your name, email address, telephone number, billing address and delivery address;
- order and transaction information, including the books ordered, price, payment status, delivery method and correspondence about the order;
- account information when you create a customer account;
- enquiry, manuscript, rights, trade or institutional information that you choose to send us;
- technical information such as IP address, browser type, device information, security logs and essential cookie data;
- marketing preferences where you choose to receive updates from us.
Payment card information is normally collected and processed directly by the payment provider shown at checkout. We do not normally receive or store your complete card number.
3. Why we use personal information
| Purpose | Typical lawful basis |
|---|---|
| Processing, delivering and supporting orders | Performance of a contract and steps taken at your request before entering a contract |
| Responding to enquiries and managing publishing, rights, trade or institutional relationships | Legitimate interests, contract or steps taken at your request |
| Keeping accounting, tax and company records | Legal obligation |
| Preventing fraud, securing the website and resolving disputes | Legitimate interests and legal obligation |
| Sending optional newsletters or promotional updates | Consent, or another lawful basis permitted for existing customers where applicable |
4. Who receives the information
We may share limited information with service providers only where necessary, including website hosting and maintenance providers, WooCommerce-related services, payment processors, delivery companies, professional advisers, accountants, fraud-prevention and security providers, and public authorities where disclosure is legally required.
We do not sell personal information to advertisers.
5. International transfers
Some service providers may process information outside the United Kingdom. Where this happens, we require an appropriate legal mechanism and safeguards under UK data protection law, such as adequacy regulations or approved contractual protections.
6. How long we keep information
We keep information only for as long as reasonably necessary for the purpose for which it was collected, including order fulfilment, customer service, accounting and tax obligations, rights administration, fraud prevention and the establishment or defence of legal claims. Retention periods vary according to the type of record and legal requirements.
7. Your rights
Subject to the conditions and exemptions in UK data protection law, you may have the right to request access, correction, deletion, restriction, objection, data portability, and withdrawal of consent. You may also object to direct marketing at any time.
To exercise a right, email contact@orchestrabooks.co.uk. We may need to verify your identity before acting on a request.
8. Cookies and similar technologies
We use essential technologies to operate the shop, basket, checkout, security and customer accounts. Optional technologies should be used only in accordance with your choice. See our Cookie Policy and the cookie settings control in the footer.
9. Marketing communications
Where you subscribe to updates, you can unsubscribe using the link in the message or by contacting us. Service messages about an order are not marketing and may still be sent when necessary to fulfil the contract.
10. Security
We use reasonable technical and organisational measures to protect personal information. No internet service can guarantee absolute security, so please use a strong unique password for your account and contact us promptly if you suspect unauthorised access.
11. Children
The online shop is intended for adults. We do not knowingly use the website to collect personal information from children for marketing purposes.
12. Complaints and contact
Please contact us first so that we can try to resolve any concern. You also have the right to complain to the UK Information Commissioner’s Office. Information about making a complaint is available on the ICO website.
13. Changes to this policy
We may update this policy when our services, providers or legal obligations change. The date at the top shows the latest revision.
Who we are
Suggested text: Our website address is: http://orchestrabooks.co.uk.
Comments
Suggested text: When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.
An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.
Media
Suggested text: If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.
Cookies
Suggested text: If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.
If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.
When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select "Remember Me", your login will persist for two weeks. If you log out of your account, the login cookies will be removed.
If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.
Embedded content from other websites
Suggested text: Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.
These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.
Who we share your data with
Suggested text: If you request a password reset, your IP address will be included in the reset email.
How long we retain your data
Suggested text: If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.
For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.
What rights you have over your data
Suggested text: If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.
Where your data is sent
Suggested text: Visitor comments may be checked through an automated spam detection service.