1. Scope and Applicability

This Privacy Policy outlines how we collect, process, and safeguard personal data obtained through the Website in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By accessing this Website or submitting personal data, you consent to the practices described herein.

2. Data Controller

The Data Controller responsible for your personal data under this Policy is: Anvil Square

3. Types of Data Collected

We may collect and process the following categories of personal data:

• Identity Data: Full name, institution name, department

• Contact Data: Email address, physical billing address

• Transactional Data: Purchase history, download history

• Technical Data: IP address, browser type, access times, referring URLs

• Usage Data: Site activity, navigation patterns, analytics data via cookies

4. Purposes of Processing

We process personal data for the following lawful purposes:

• To fulfil and manage your licensing purchase or enquiry

• To verify institutional affiliation and licensing compliance

• To deliver requested downloads and support services

• To maintain records of purchases for legal and contractual obligations

• To display your institution’s name (unless opted out) in the Recent Adoptions section

• To improve the user experience through anonymised analytics and security monitoring

5. Lawful Basis for Processing

We rely on the following legal bases:

• Contractual Necessity — to fulfil the agreement for purchase/licensing

• Legitimate Interest — to protect the Website, monitor performance, and promote the work via institutional name use

• Legal Obligation — to comply with HMRC and recordkeeping requirements

• Consent — for optional cookies or marketing (where applicable)

6. Data Retention

We will retain personal data only for as long as necessary to fulfil the purposes outlined in this policy, including compliance with legal, tax, or accounting requirements. Typically, this period will not exceed six years unless otherwise required.

7. Third-Party Services

Your payment may be processed by third-party processors such as Stripe or PayPal. These platforms operate under their own data protection policies, which we do not control.

We do not sell, lease, or disclose your data to unrelated third parties for marketing or profiling.

8. Cookies and Tracking

This Website may use essential and analytical cookies to:

• Maintain session functionality

• Track navigation patterns to improve performance

• Measure the popularity of certain pages or downloads

You may configure your browser to block or delete cookies, though this may impair site functionality.

9. Institution Name Listing

We may publicly display your institution’s name on our Website under “Recent Adoptions” to acknowledge support and increase transparency.

10. Data Subject Rights

You have the following rights under the UK GDPR:

• Access – Request a copy of personal data we hold about you

• Rectification – Request corrections to incomplete or inaccurate data

• Erasure – Request deletion of data where there is no legal reason to retain it

• Objection – Object to certain types of processing

• Portability – Request a machine-readable copy of your data

• Restriction – Request suspension of processing in specific circumstances

• Complaint – Lodge a complaint with the UK’s Information Commissioner’s Office (ICO)

To exercise your rights, please contact us via email at [Insert Email Address].

11. Security

We implement industry-standard security protocols to safeguard your data, including encryption, secure server connections (SSL), and restricted access to administrative systems.

12. Amendments to This Policy

We reserve the right to amend this Privacy Policy at any time. Changes will be published on this page with an updated Effective Date.

13. Contact

For any questions, requests, or concerns regarding your privacy or data protection, please contact:

Edward T Hutchinson

Email: ed@anvilsquare.co.uk