Your data, handled plainly.

At Excello Books, we respect your personal information and are committed to handling it responsibly. This Privacy Policy explains what information we collect, how we use it, and the choices available to you.

1. Who we are (data controller)

The data controller responsible for your personal information is Excello Books Ltd, a company registered in England and Wales under company number 10487109, trading as "Excello Books", of 170 Heys Road, Prestwich, Manchester, England, M25 1QL. You can contact us about privacy matters through our contact page or at info@excellobooks.co.uk.

2. Information we collect

When you use our website, create an account, place an order, or contact us, we may collect information such as:

• Your name and email address.
• Your account login credentials. Passwords are stored using industry-standard one-way hashing (via bcrypt) and related security measures — we do not store passwords in plain text or in a form that we, or anyone else, can reverse to read the original password.
• Shipping address and contact number for order fulfilment.
• Order details, purchase history, and delivery status.
• Information you voluntarily provide when contacting our customer support.

We only collect information that is reasonably necessary to provide our products and services.

3. How we use your information, and our legal basis

Where UK or EU data protection law applies, we rely on the following legal bases for each purpose:

• Create and manage your customer account, process and deliver your orders, and provide access to purchased digital products — necessary to perform our contract with you (or to take steps at your request before entering into one).
• Respond to customer enquiries and support requests, and send order confirmations, delivery updates, and service-related communications — performance of our contract and our legitimate interest in providing good customer service.
• Screen registration and contact-form submissions for automated/bot abuse (using a captcha service) — our legitimate interest in preventing fraud and abuse of our website. This is an automated check limited to distinguishing humans from bots; it does not make decisions about you with legal or similarly significant effects.
• Improve our website, products, and customer experience — our legitimate interest in operating and improving our business, balanced against your rights.
• Comply with applicable legal and regulatory requirements, including tax and accounting rules — legal obligation.
• Non-essential cookies or similar technologies, if we introduce them — your consent, which you can withdraw at any time (see Section 6).

We do not use your personal information for purposes unrelated to our business without an appropriate legal basis.

4. Payment information

Online payments are securely processed through independent third-party payment service providers, including Stripe. Payment information is collected and processed directly by those providers under their own privacy policies.

Excello Books does not store or have access to your complete card number, banking credentials, or CVV. Depending on the payment method, we may receive limited transaction details from our payment provider, such as the card brand, the last four digits of the card, the billing name and address, and a payment or transaction reference — we use this only to confirm, reconcile, and support your order.

For Cash on Delivery (COD) orders, payment is collected by the authorised delivery partner at the time of delivery.

5. Cookies and similar technologies

We currently use only essential/strictly-necessary cookies and similar technologies — for example, to keep you signed in, maintain a secure session, and remember your shopping cart contents. These do not require your consent because the website cannot function properly without them.

If we introduce analytics, performance, or marketing cookies in the future, we will update this policy, name the specific cookies, their provider, purpose and duration, and ask for your consent through a cookie banner before setting any that isn't essential. You will be able to withdraw that consent at any time. You can also adjust your browser settings to manage or disable cookies generally, although essential cookies are required for core features (such as staying logged in) to work.

6. Sharing of information

We do not sell, rent, or trade your personal information.

We share limited information only where reasonably necessary to run our business, including with the following categories of service provider:

• Stripe — payment processing.
• Render — website and application hosting.
• Our database hosting provider (currently hosted on Render's infrastructure; migrating to Turso) — storage of account and order data.
• Resend — sending transactional emails (such as order confirmations and account emails).
• hCaptcha — bot and fraud-prevention checks on forms.
• Authorised courier or logistics partners — delivery of physical orders.
• Other service providers assisting with website operations or customer support, under appropriate confidentiality obligations.
• Government authorities or regulatory bodies where disclosure is required by applicable law or legal process.

Some of these providers may process information outside your country of residence, including in the United States. Where this involves a transfer of personal information out of the UK or EEA, we take steps to ensure it is protected to a standard consistent with UK/EU data protection law, such as relying on providers' Standard Contractual Clauses or equivalent safeguards.

7. Data security

We use commercially reasonable administrative, technical, and organisational measures to help protect personal information against unauthorised access, misuse, alteration, or disclosure.

While we strive to protect your information, no method of electronic transmission or storage can be guaranteed to be completely secure. Therefore, we cannot guarantee absolute security.

8. Data retention

We retain personal information only for as long as reasonably necessary. As a general guide:

• Account information is retained for as long as your account remains active, and for a reasonable period afterwards in case you wish to reactivate it or raise a query.
• Order and transaction records, including information needed for tax and accounting purposes, are typically retained for at least 6 years after the relevant tax year, in line with UK record-keeping requirements, or a comparable period where a different jurisdiction's rules apply.
• Customer support correspondence is retained for as long as reasonably needed to resolve the matter and for a reasonable period afterwards to handle any follow-up or dispute.

When information is no longer required for these purposes, we will take reasonable steps to securely delete or anonymise it.

9. Your rights

Subject to applicable law, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your personal information, where applicable.
• Object to processing based on our legitimate interests.
• Restrict how we process your information in certain circumstances.
• Data portability — receive certain information you provided to us in a structured, commonly-used, machine-readable format, where technically feasible.
• Withdraw consent at any time, where processing is based on consent (such as optional cookies), without affecting processing already carried out.
• Update your account details directly through your account settings.

We may request reasonable verification of identity before processing certain requests, and some rights may not apply in every case depending on the legal basis for processing. You can reach us any time through the contact page.

If you are not satisfied with how we've handled your personal information, you have the right to complain to your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO), reachable at ico.org.uk. We'd appreciate the chance to address your concern directly first, but you're not required to contact us before contacting the ICO or an equivalent authority.

10. Children's privacy

Our website and services are intended for a general audience and are not specifically directed towards children. We do not knowingly collect personal information from children where prohibited by applicable law. If we become aware that such information has been collected unintentionally, we will take reasonable steps to remove it.

11. Changes to this Privacy Policy

We may revise this Privacy Policy from time to time to reflect changes in our services, legal obligations, or business practices. The updated version will be posted on this page with the revised "last updated" date. Continued use of our website after changes become effective constitutes acceptance of the updated policy.

12. Contact us

If you have any questions regarding this Privacy Policy or your personal information, please contact Excello Books through the contact page.

This Privacy Policy is provided for general informational purposes and does not constitute legal advice. Depending on the countries in which Excello Books operates or serves customers, additional legal requirements (such as GDPR, UK GDPR, or other applicable privacy laws) may apply.