Privacy Policy

Last updated: October 2026

Information and purposes

We receive your name, email, billing and country details, order information, preferences and correspondence when you provide them through an enquiry, resource request, purchase or subscription. SendOwl and Stripe supply transaction and delivery records. Stripe handles payment-card data; checkout does not give us your full card number or security code.

Providers process relevant IP addresses, device/browser information and request records to deliver and secure their services. Optional analytics, advertising technologies and email tracking are not enabled. See our Cookie Policy.

We use information for these purposes and lawful bases:

·  Orders, delivery, licensing and support: performing our contract or taking steps you request before a contract.

·  Free resources and general enquiries: our legitimate interests in providing requested information and supporting readers, or pre-contractual steps where applicable.

·  Tax and accounting: compliance with legal obligations.

·  Security and product protection: our legitimate interests in secure operations and preventing unauthorised distribution. PDF watermarks contain your order number, identifying the licensed copy to anyone receiving the file.

·  Complaints and legal matters: performing contractual duties, complying with legal obligations and our legitimate interests in resolving disputes and protecting legal rights, as applicable.

·  Marketing: your consent to use relevant contact details and preference records for Rosefield Publishing news, educational content and offers about our publications and resources.

We assess necessity and balance legitimate interests against your rights. Do not send sensitive or confidential third-party information unless a suitable arrangement has been agreed.

Email choices

A purchase or free-checklist request does not automatically subscribe you to marketing. Consent is separate and optional. Unsubscribe using the email link or contact us. Earlier lawful processing is unaffected, and necessary order and product-correction messages may continue.

Providers and disclosures

We use Squarespace for website hosting; SendOwl for checkout, orders, delivery and PDF watermarking; Stripe for payments, refunds and security; and Google Workspace for business email. Mailing-list and email-delivery providers process subscription and consent records on our behalf.

Providers acting on our instructions are subject to processing arrangements. Stripe also acts as a controller for certain independent purposes, including compliance and fraud prevention. Google separately processes service data as described in its notice.

Provider information: Squarespace, SendOwl, Stripe, Google's processing terms and service-data notice.

We may disclose necessary information to professional advisers, authorities or other recipients to meet legal obligations, resolve payment disputes or establish, exercise or defend legal rights.

International processing

Our providers may process personal information outside the UK. Applicable safeguards must be in place for restricted international transfers.

[COMPLETE BEFORE PUBLICATION: actual processing countries and applicable adequacy decisions or contractual safeguards for the services used, including SendOwl and the mailing provider.]

Contact us for information about the applicable safeguards and how to obtain a copy. A purchase or acceptance of our terms is not consent to international transfers.

Retention

We retain only information needed for the relevant purpose, then delete or anonymise it. Our retention rules are:

·  Tax records: at least five years after the relevant 31 January submission deadline, longer if required. Core order, licence and purchase-consent evidence normally follows the same period as the related transaction records.

·  Closed routine enquiries and free-resource delivery records: normally 12 months after completion without an ongoing relationship. Order or dispute records follow the relevant rule instead.

·  Marketing subscriptions: until consent is withdrawn or no longer valid. We review necessity annually and remove inactive details within five years of the last meaningful interaction, such as a purchase, reply or renewed consent. Sending emails alone does not reset that period.

·  Marketing consent evidence: minimal evidence, normally five years after withdrawal, subject to continued necessity. Minimal suppression records remain for as long as needed to honour an unsubscribe request.

·  Security and download logs: for the operational period needed for security, delivery and fault investigation, taking account of provider retention cycles. Relevant dispute or incident evidence may be retained separately for up to five years after closure where justified.

·  Backups and deleted items: removed through the applicable deletion or backup cycle. Pending copies are restricted to recovery and security; deletion requests are reapplied after restoration.

Information needed for an unresolved matter or legal duty may be kept longer, with necessity reviewed. The tax-record period does not apply to all personal information.

Controller and scope

Dylan Clark, a sole trader trading as Rosefield Publishing, is the controller responsible for the personal information described here. Address: 19 Upper Holt Street, Earls Colne, Essex CO6 2PG, United Kingdom. Email: office@rosefieldpublishing.co.uk.

This policy covers our website, enquiries, digital-product orders, free-resource requests and optional email marketing.

Your rights and contact

Depending on the circumstances, you have rights of access, correction, erasure, restriction and portability. You may withdraw consent at any time. You may object to processing based on legitimate interests, and you may object to direct marketing at any time.

Contact office@rosefieldpublishing.co.uk to exercise a right. We may verify identity and normally respond within one month without a fee, subject to lawful exceptions. Required order or delivery information enables fulfilment; marketing details are optional.

We acknowledge data-protection complaints within 30 days, investigate and explain the outcome without undue delay. You may also complain to the Information Commissioner's Office or another supervisory authority where applicable.

We update this policy when practices change and show the revision date above. Where required, we will provide further notice or obtain fresh consent.