Effective Date: July 2026

Company: Hack Publishing Ltd (Company No. 12551051)

Registered Office Address: Queensgate House, 48 Queen Street, Exeter, EX4 3SR

Data Controller Contact: office@hack-publishing.co.uk

ICO Registration Number: ZB025900

At Hack Publishing Ltd (“we”, “us”, “our”), we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your information when you visit our website (hack-publishing.co.uk), purchase our editing or mentoring services, enroll in our online courses, or interact with us.

1. Important Information & Who We Are

Data Controller

Hack Publishing Ltd is the data controller responsible for your personal data. If you have any questions about this Privacy Policy or wish to exercise your legal rights, please contact us at office@hack-publishing.co.uk.

Complaints

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us first.

2. Information We Collect About You

We may collect, use, store, and transfer different kinds of personal data about you, categorized as follows:

• Identity Data: First name, last name, username, title, or pen name.
• Contact Data: Email address, billing address, postal address, and telephone number.
• Financial & Transaction Data: Payment card details (processed securely via third-party processors; we do not store full card numbers on our servers), bank account details, and details of services or digital products purchased from us.
• Manuscript & Creative Content Data: Text, drafts, notes, story ideas, or documents you submit to us for editing, critique, mentoring, or publishing assessment.
• Technical & Usage Data: IP address, browser type and version, time zone setting, operating system, and information about how you interact with our website and course portals.
• Marketing & Communications Data: Your preferences in receiving email newsletters, marketing, or updates from us.

Special Category Data: We do not intentionally collect “Special Category Data” (e.g., health data, political opinions, trade union membership). However, if your submitted manuscript contains sensitive personal information within fictional or biographical writing, you acknowledge that you have voluntarily provided this data for performance of the service.

3. How We Collect Your Personal Data

We use different methods to collect data from and about you:

• Direct Interactions: You fill in forms on our site, purchase a product or service, upload a manuscript, subscribe to our email newsletter, or communicate with us by email or contact forms.
• Automated Technologies: As you interact with our website, we automatically collect Technical Data about your equipment, browsing actions, and patterns via cookies and server logs.
• Third Parties / Publicly Available Sources: We receive functional data from third-party service providers (e.g., payment processors like Stripe, analytics tools, and automated form/CRM plugins).

4. How We Use Your Personal Data & Legal Basis

We will only use your personal data when UK law allows us to. Most commonly, we process your data under the following legal bases under UK GDPR:

1. Performance of Contract: Where we need to fulfill a contract we have entered into with you (e.g., delivering an edit, providing course access, or processing an order).
2. Legitimate Interests: Where it is necessary for our legitimate business interests (e.g., improving our software/website, managing client administration, or preventing fraud) and your interests do not override those.
3. Legal Obligation: Where we need to comply with a legal or regulatory obligation (e.g., financial record-keeping for HMRC).
4. Consent: Where you have given explicit consent (e.g., subscribing to our marketing newsletter). You can withdraw consent at any time.

Summary of Data Processing Activities

Activity / Purpose	Type of Data	Legal Basis for Processing
Account Creation & Order Processing	Identity, Contact, Financial, Transaction	Performance of Contract
Delivering Services (Editing, Mentoring, Courses)	Identity, Contact, Manuscript/Creative Content	Performance of Contract
Processing Payments & Issuing Refunds	Contact, Financial, Transaction	Performance of Contract & Legal Obligation
Sending Transactional Emails (Logins, Invoices)	Identity, Contact	Performance of Contract
Marketing Newsletters & Updates	Identity, Contact, Marketing Preferences	Consent (Opt-in)
Website Administration, Security & Analytics	Technical, Usage	Legitimate Interests & Consent (Cookies)

5. Sharing Your Personal Data

We never sell or rent your personal data or manuscript materials to third parties.

To deliver our services, we share necessary data with trusted third-party service providers acting as Data Processors under strict confidentiality obligations:

• Freelance Editors & Reviewers: Vetted independent contractors bound by strict Non-Disclosure Agreements (NDAs) who receive manuscript data solely to perform assigned editing or critique services.
• Payment Processors: Secure gateways (e.g., Stripe) to handle card transactions.
• Technical Infrastructure & Software: Cloud hosting platforms, website database tools, CRM/email automation software, and form submission platforms used to operate our business and deliver customer portals.
• Professional Advisers: Accountants, auditors, insurers, and legal advisers to comply with UK statutory regulations.

6. International Data Transfers

Some of our third-party software providers or cloud hosting servers may be located outside the United Kingdom (e.g., in the European Union or the United States).

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded by ensuring at least one of the following safeguards is implemented:

• The country has been officially declared by the UK government to provide an adequate level of protection for personal data.
• We use specific contracts approved for use in the UK (such as the International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs) which give personal data the same protection it has in the UK.

7. Data Security & Manuscript Protection

We have put in place appropriate security measures to prevent your personal data and intellectual property from being accidentally lost, used, accessed in an unauthorized way, altered, or disclosed.

• Manuscript Confidentiality: Your submitted manuscripts and creative ideas remain 100% your intellectual property. Access is restricted exclusively to authorized staff and assigned freelance editors working directly on your project.
• Access Control: Access to personal data is strictly limited to employees, contractors, and agents who have a business need to know.
• Data Breaches: We have procedures in place to deal with any suspected personal data breach and will notify you and the ICO where we are legally required to do so.

8. Data Retention: How Long We Keep Your Data

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements:

• Customer Account & Transaction Data: Retained for 6 years following the end of the tax year in which the transaction took place, to comply with HMRC tax and accounting laws.
• Manuscripts & Submitted Client Files: Retained during active service delivery and kept for up to 12 months following project completion to allow for follow-up queries or revisions, after which files are securely archived or deleted upon request.
• Marketing Contact Data: Retained until you unsubscribe or request deletion.

9. Your Statutory Legal Rights

Under UK GDPR, you have rights in relation to your personal data:

• Request access to your personal data (commonly known as a “data subject access request”).
• Request correction of inaccurate or incomplete data.
• Request erasure of your personal data (“right to be forgotten”), where there is no good legal reason for us continuing to process it.
• Object to processing based on legitimate interests or for direct marketing.
• Request restriction of processing your personal data temporarily.
• Request transfer of your personal data (data portability) to you or a third party.
• Withdraw consent at any time where we rely on consent to process your data.

To exercise any of these rights, email us at office@hack-publishing.co.uk. We aim to respond to all legitimate requests within one calendar month.

10. Cookie Notice

Our website uses cookies and similar tracking technologies to distinguish you from other users, provide smooth platform functionality, and analyze performance.

What are Cookies?

Cookies are small text files placed on your computer or mobile device when you browse websites.

Types of Cookies We Use:

1. Strictly Necessary Cookies: Essential for the website to function (e.g., enabling user account logins, shopping cart operations, and secure checkout navigation). These cannot be switched off.
2. Analytical / Performance Cookies: Allow us to recognize and count visitors and see how users move around our site. This helps us improve website usability and user experience.
3. Functional Cookies: Recognize you when you return to our website, allowing us to remember your preferences (e.g., choice of language or login state).

Managing Cookies

When you first visit our website, you will be presented with a Cookie Consent Banner allowing you to accept non-essential cookies or customize your preferences. You can also block cookies at any time by altering your web browser settings. However, blocking strictly necessary cookies may impact platform functionality and course portal access.

11. Changes to This Privacy Policy

We keep our Privacy Policy under regular review. Any updates will be posted on this page with an updated “Effective Date.”