Privacy Policy

1. Who is responsible

The data controller is {{PLACEHOLDER: registered legal entity name}}, {{PLACEHOLDER: registered address}}, Albania. Contact: [email protected].

There is no data protection officer, because the scale of processing here does not require one. The address above reaches the people who make the decisions.

This site has no user accounts, no login, no comments, no forum and no user-generated content. There is nothing to create and nothing stored against you as a profile.

2. What is collected, and why

Three things, and each has a different legal basis under the UK GDPR and the EU GDPR.

Your cookie choice is stored in your own browser under koit-consent and is not transmitted anywhere. Nothing in rows two and three exists until you consent — rejecting means the tags are never requested, not that they load and then anonymise.

There is no profiling and no automated decision-making that produces legal or similarly significant effects.

3. What Payhip and PayPal collect

Payhip is the merchant of record for the transaction. That means Payhip — not this site — collects and controls what you enter at checkout, which will include your name, your email address, your country for tax purposes, and whatever PayPal passes back to complete the sale. Both companies process that data under their own privacy policies, linked in the next section.

What reaches us afterwards is the record of a sale: which product, when, and the email address attached to it. That is what makes a support request answerable and a refund possible. It is not added to the mailing list, because subscribing was not what you asked for at checkout.

This site is a set of static files. It has no database and no server-side code, so there is nowhere on it for a payment detail to be stored even in principle.

4. Who else sees it

Every company that touches your data, what they do, and their own policy:

Nobody else. Your data is not sold, rented, traded or shared with advertisers or list brokers, and there is no arrangement under which it could be.

5. How long it is kept

Real periods, because "as long as necessary" is not an answer:

• Mailing list — until you unsubscribe, then 30 days. After unsubscribing your address is kept for thirty days so an accidental unsubscribe can be reversed, then deleted. A suppression record may be kept indefinitely for the sole purpose of not emailing you again.
• Inactive subscribers — 24 months. An address that has not opened anything in two years is deleted, whether or not you unsubscribe.
• Order records — 7 years. Held by Payhip. This is a tax and accounting requirement, not a choice, and it is why an order record cannot be deleted on request in the way a mailing-list entry can.
• Support emails — 24 months from the last message in the thread.
• Analytics — 14 months. The shortest retention Google Analytics 4 offers.
• Advertising identifiers — 90 days, which is the lifetime of the cookies concerned.
• Server logs — 30 days.
• Your cookie choice — until you clear your browser storage. It never leaves your device.

6. Your rights, and how to use them

Under the UK and EU GDPR you have the right to:

• Access — a copy of what is held about you.
• Rectification — correction of anything wrong.
• Erasure — deletion, except where a record must be kept for tax purposes, in which case you will be told which record and why.
• Portability — your data in a machine-readable format.
• Objection — to any processing based on legitimate interest.
• Restriction — to have processing paused while a dispute is resolved.
• Withdrawal of consent — at any time, for the mailing list and for cookies alike, without affecting anything done before you withdrew it.

Two of these need no email at all. Unsubscribing is one click at the bottom of any message we send. Cookie consent can be changed whenever you like fromthe cookie policy.

For everything else, email [email protected] from the address concerned, or tell us which address it is. You will get a response within one month, which is the statutory deadline, and usually far sooner. There is no charge.

If you are not satisfied with how a request was handled, you can complain to a supervisory authority. In the UK that is theInformation Commissioner's Office; in the EU it is the data protection authority of the country you live in. You do not have to raise it with us first, though it is usually quicker.

7. International transfers

Several of the processors above are based in the United States, so data reaches servers outside the UK and the EEA. Those transfers rely on the UK and EU adequacy decisions for the US Data Privacy Framework where the company is certified under it, and on Standard Contractual Clauses where it is not.

In plain terms: your email address is stored on infrastructure that may be outside your country, under contractual terms intended to give it comparable protection. If that is not acceptable to you, the practical answer is not to join the mailing list — the guides, the blog and the checkout all work without it.

8. Children's data

This site is not directed at children and its products are not written for them. We do not knowingly collect data from anyone under 16, and no marketing is targeted at that age group.

If you believe a child has given us an email address, tell us at[email protected] and it will be deleted without asking for anything further.

9. Changes to this policy

When this policy changes, the date at the top of the page changes with it. Substantive changes — a new processor, a new purpose, a longer retention period — are announced to the mailing list before they take effect, so a change cannot happen quietly to people who have given us an address.

Previous versions are not published. If you need to know what the policy said on a given date, ask.