Privacy Policy

Last Updated: October 2026 • Compliant with UK GDPR & Data Protection Act 2018

1. Who We Are (Data Controller)

This privacy notice explains how Highland Noir Press ("we", "us", or "our") collects, uses, and protects personal data when you visit our website or purchase digital editions of COLD IS THE LOCH by Callum MacLeod.

We take your privacy seriously and act in strict adherence to the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Personal Data We Process

Depending on your interactions with our site, we process the following categories of data:

Order & Contact Data: Name, email address, postal billing country, and transaction receipt details provided during checkout. Note: Sensitive cardholder details (such as full 16-digit card numbers or CVV) are encrypted and processed directly by our PCI-DSS Level 1 certified payment processor, Hotmart. We never see or store your payment card numbers.
Technical & Usage Data: Anonymized or pseudonymized IP addresses, browser types, device screen resolutions, referring URLs (UTM campaign parameters), and pages visited.
Preferences: Your chosen cookie consent state and selected book edition.

3. Lawful Bases for Processing

Under Article 6 of the UK GDPR, we only process your personal information under the following lawful bases:

Performance of a Contract: To process your order, deliver your digital download links and web-reader credentials, and handle 7-day guarantee refund requests.
Legitimate Interests: To detect fraudulent transactions, monitor site stability, and improve reader experience.
Consent: For non-essential marketing and measurement cookies (such as Meta Pixel and Google Analytics), which are only activated if you accept our cookie consent banner.

4. Third-Party Service Providers (Data Processors)

We only share necessary data with trusted, GDPR-compliant service providers:

Service Provider	Purpose	Data Transferred
Hotmart	Merchant of Record, payment processing, tax compliance & file delivery	Name, email, transaction total, IP
Meta Platforms Ireland Ltd	Advertising attribution & campaign measurement (Meta Pixel)	Aggregated event data (PageView, InitiateCheckout) with prior cookie consent
Google LLC (GA4)	Aggregate site traffic and readership engagement analytics	Anonymized browser/device metrics with prior cookie consent

We do NOT sell, rent, or trade your personal data to any third-party marketing brokers.

5. Data Retention

We retain transaction and customer service records for the duration required to provide ongoing download access and to satisfy statutory UK accounting, tax, and legal obligations (typically 6 years). Web analytics data is retained in aggregated form for up to 14 months.

6. Your Rights Under UK GDPR

As a resident of the United Kingdom, you possess clear rights regarding your personal data:

Right of Access: Request a copy of the personal information we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete records.
Right to Erasure ("Right to be Forgotten"): Request deletion of your data where no overriding legal basis requires retention.
Right to Restrict or Object to Processing: Object to processing based on legitimate interests or direct marketing.
Right to Withdraw Consent: Revoke cookie consent at any time via our Cookie Policy.

To exercise any of these rights, please contact our data team via our Imprint & Contact page.

7. Right to Lodge a Complaint with the ICO

If you have any unresolved concerns about our data practices, you have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.