Privacy Policy

1. Who we are

storyshelvesjumble.courses is operated by Storyshelvesjumble Learning Ltd, a company registered in England and Wales under company number 14827391, with its registered office at Unit 4, 27 Kelvin Row, Manchester, M1 5QT, United Kingdom. For the purposes of the UK GDPR and the EU General Data Protection Regulation, we are the data controller for personal data processed through this website. General enquiries: [email protected]. Data protection enquiries: [email protected].

2. What data we collect

We keep collection deliberately narrow. We do not sell personal data and we do not operate advertising profiles.

Information you give us. When you use the contact form we receive the name, email address, subject category and message content you submit, together with the date and time of the submission.
Technical information. Our hosting provider records standard server logs including IP address, user agent, requested URL, referrer and timestamp. These logs exist for security, abuse prevention and diagnostics.
Analytics information. Where you have consented to analytics cookies, we collect aggregated measures such as pages viewed, approximate region, device category and time on page.
Preference information. Your cookie consent choice is stored locally in your browser so that the banner does not reappear on every page.

We do not knowingly collect data from children under 13, and we do not request special category data such as health information. Please do not include medical details in a contact form message.

3. Why we process it, and our lawful bases

To reply to your enquiry — legitimate interests, and performance of a contract where your message concerns an agreement with us.
To keep the site secure and available — legitimate interests in preventing abuse, spam and unauthorised access.
To understand which guides are useful — consent, given through the cookie banner and withdrawable at any time.
To comply with legal obligations — for example retaining records where law requires it.

4. Cookies and similar technologies

We use a small number of cookies and browser storage entries. Essential entries record your consent choice and support basic security; analytics and functional entries are set only after you opt in. A full table of the categories, their purposes and their lifespans is available in our cookie policy, which also explains how to withdraw consent and how to block or delete cookies in each major browser.

5. Third-party processors

We share personal data only with service providers who process it on our instructions under a written data processing agreement. The categories we rely on are:

Website hosting and content delivery — serves the pages, stores server logs, mitigates denial-of-service attacks.
Transactional email and form delivery — routes contact form submissions to our mailbox and stores the resulting messages.
Privacy-focused analytics — produces aggregated usage statistics, only where analytics consent has been given.
Image delivery — decorative photography on this site is requested from a third-party placeholder image service, which will see your IP address as part of serving the image.

Where a processor operates outside the UK or EEA, transfers are made under an adequacy decision or under the UK International Data Transfer Addendum or EU Standard Contractual Clauses, with additional safeguards where appropriate. We will name the current processors on request to our data protection contact.

6. Retention

Contact form correspondence — kept for up to 24 months after the matter is closed, then deleted, unless a longer period is needed to deal with a legal claim.
Server logs — typically retained for up to 90 days by our hosting provider.
Aggregated analytics — retained in aggregated, non-identifying form for up to 26 months.
Consent records — held in your browser until you clear site data, and for up to 12 months in any server-side record.

7. Your rights

If the UK or EU GDPR applies to you, you have the right to be informed; to request access to your personal data; to rectification of inaccurate data; to erasure; to restriction of processing; to data portability; to object to processing based on legitimate interests; and to withdraw consent at any time without affecting processing already carried out. You also have the right not to be subject to solely automated decision-making with legal effects — we do not carry out such processing.

If you are a California resident, the CCPA as amended gives you the right to know what personal information is collected, used, shared or sold; the right to delete personal information; the right to correct inaccurate information; the right to opt out of the sale or sharing of personal information (we do not sell or share personal information as those terms are defined); and the right not to be discriminated against for exercising these rights. You may exercise these rights yourself or through an authorised agent.

To make a request, email [email protected] or write to the registered address above. We respond within one month for GDPR requests and within 45 days for CCPA requests, and we will tell you if we need an extension. We may ask for information to confirm your identity, used only for that purpose.

8. Security

The site is served over HTTPS. Access to form submissions is limited to staff who need it, protected by unique credentials and multi-factor authentication. We patch our platforms, keep dependencies minimal, and review access periodically. No system is perfectly secure; if a breach affects your rights and freedoms we will notify the relevant supervisory authority and, where required, you.

9. Complaints

Please raise concerns with us first — most issues are resolved quickly. You may also complain to a supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EEA it is the authority in your country of residence. California residents can find guidance from the state Attorney General at oag.ca.gov/privacy/ccpa.

10. Changes to this policy

We update this policy when our processing changes. The "last updated" date at the top of the page always reflects the current version, and material changes will be signposted on the home page for at least 30 days.