Privacy Policy

BookSource
Data Privacy Policy 
May 2018

This information is our privacy notice. It explains what we do with your personal information, why
we want to use it, how we protect it and what rights you have to control our use of your personal
data.  The most important fact is that it’s your personal data. We have complete respect for your rights and we will only use it where necessary to deliver our services to you or your business, or to keep you up to date about developments in our services.

 

INFORMATION ABOUT US
BookSource acts as both Data Controller and Data Processor. Our registered address is 50
Cambuslang Road, Glasgow G32 8NB. We are registered in Scotland, No. SC159052. If you want to
contact us about any of the points in this notice, or just generally about how we protect your
privacy, please email us at enquiries@booksource.net.

 

THE PURPOSE AND LAWFUL BASIS FOR PROCESSING YOUR PERSONAL DATA
We collect personal information for a few different purposes and these each have a different lawful
basis. If you are a BookSource client, we hold your name and full contact details because we have a
contractual obligation to deliver services to you. We need your contact details to deliver our services
(such as to send you update emails when you need to take actions, update you on our services, send
you stats and invoices and so on.) We also use your data to make our services smarter, faster,
secure, integrated and useful to you. We will continue to hold your information for six years from
the expiry of your contract with us for legal records.  If you are a BookSource customer (or a client publisher’s customer), we will hold your name, full contact details, and details of your orders because we have a contractual obligation to deliver services to our clients. We need your details in order to allow us to send you our clients’ products, invoice you for them and collect cash from you on their behalf. We also have a legal obligation to record your details should they be required by the authorities (eg HMRC).  If you are a supplier or other business associated with BookSource, we will hold your contact details because we have a legitimate interest in doing business with your company. We will aim to hold this information for three years since we were last in contact with you.
If you visit our website, we use Google on our website to track user activity so we can improve our
service. We may record your computer’s IP address so we can tell how each user and repeat visitor is
using our site. Analytics data is collected via a JavaScript tag in the pages of our site and is not tied to personally identifiable information. We have a legitimate interest in tracking user journeys on the
site so that we can improve our service. You can find out more about Google privacy by visiting
https://policies.google.com/privacy. We may also offer you targeted offers in relation to your activity. We will hold IP information for a maximum of three years from the time of your last visit to
our site. If you call us, we may monitor and record communications with you, including emails and phone conversations. Any information we collect may be used for the daily operations of the business, training purposes and to ensure we fulfil our legal and regulatory obligations.

 

COOKIES
We use a number of different cookies on our sites. If you do not know what cookies are, or how to
control or delete them, we recommend you visit http://www.aboutcookies.org for detailed
guidance.  The list below describes the cookies we use on the site and what we use them for. Currently we operate an ‘implied consent’ policy which means that we assume you are happy with this usage. If you are not happy, then you should either not use the site, or delete cookies having visited the site, or you should browse the site using your browser’s anonymous usage setting (called Incognito in Chrome, InPrivate for Internet Explorer, Private Browsing in Firefox and Safari etc).  First Party Cookies are cookies that are set by the website directly and include Session Cookies and
Google Analytics Cookies.  Session Cookies are used to remember your login for you if you are a registered user and we deem these as being strictly necessary to the working of the website. If these are disabled, then various site functionality will be broken. Session cookies also allow users to be recognised within a website so any page changes or item or data selection you make is remembered from page to page. The most common example of this is a ‘shopping cart’ functionality which means that your election is remembered as you browse an e-commerce site.  Third Party Cookies are cookies set on your machine by external websites whose services are used on this site. Cookies of this type are the sharing buttons across the site which allow visitors to share content on social networks. Cookies are currently set by LinkedIn, Twitter, Facebook, YouTube,
Zopim Live Chat and Google+. In order to implement these buttons and connect them to the
relevant social networks and external sites, there are scripts from domains outside of our website.
You should be aware that some of these sites are likely to be collecting information about what you
are doing around the internet, including our site. If you are concerned, you should check the
respective policies of each of these sites to see how they use your information and to find out how
to opt out, or delete such information. The help menu on most browsers will tell you how to prevent your browser from accepting new cookies, how to have the browser notify you when you receive a new cookie and how to disable cookies altogether.

WHO WE SHARE YOUR PERSONAL DATA WITH
We use a number of different service providers (acting as data processors) who provide IT and
administration, carriage and other services to enable us to operate our business and the services we provide to our clients and customers. Your personal data may be transferred to these data
processors who generally fall under the following categories:
*Website analytics service providers
*Website and data hosting service providers
*Email, contacts and calendar service providers
*Telephone network service providers
*Accounting software service providers
*Card payment service providers
*Carrier service providers

For security reasons (to reduce the risk of phishing attacks on our customers) we do not name all our
service providers in this privacy notice. The types of personal data we hold about you (and that may
be transferred to our data processors) are set out above. Please contact us at
enquiries@booksource.net if you want further information on specific data processors or the types
of personal data they process for us.  If you are a customer we will share your personal information with our client publishers. This is because it is their products which you are buying from us and we have a contractual obligation to them in this regard (because we are their agent). In this instance we are acting as a Data Processor and our clients are the Data Controllers, and as such have the same legal obligations under this privacy notice as we do.

 

OTHER CIRCUMSTANCES IN WHICH WE MAY SHARE PERSONAL DATA WITH THIRD PARTIES
We may also share your personal data with the following third parties in certain circumstances:
*We will share personal information with law enforcement or other authorities (such as
regulatory bodies) if required by applicable law.
*We may share personal information with professional advisors such as lawyers, accountants,
or auditors in order for them to provide legal, accounting or auditing services to us.
*We will not sell or rent your information to third parties and we will never share your
information with third parties for marketing purposes other than our own marketing
activity.

 

INTERNATIONAL TRANSFERS OF PERSONAL DATA AND THE MEASURES IN PLACE TO SAFEGUARD IT
We do not directly transfer any of your data outside the European Economic Area (EEA). However,
some of our data processors may do so and this section explains the impact of these international
transfers and how your information is protected.  Many of our data processors operate ‘cloud-based systems’, which means the information is held in information data centres in different locations. All the cloud-based systems we use reserve the right to hold copies of your personal information outside the EEA to hold back-up copies, so they can guarantee recovery.  In each case we and / or our processors use one or more of the following means that are designed to help safeguard your privacy rights and give you remedies in the unlikely event of abuse:
*Certain processors may transfer your personal data to countries that have been deemed to
provide an adequate level of protection for personal data by the European Commission.
*Providers storing data in the U.S. may be self-certified to the EU-US Privacy Shield which
requires them to provide similar protection to the personal data shared between Europe
and the U.S.  Please contact us at enquries@booksource.net if you want further information on the specific mechanisms used by our data processors when transferring your personal data outside of the EEA.

 

YOUR PERSONAL DATA RIGHTS
The personal data we hold about you is your data, so you have certain rights over it. This section
summarises your rights. You can exercise any or all of these rights when you choose, and the easiest
way is by dropping us an email at enquries@booksource.net.  Where we are processing your data based on your consent (e.g. for marketing purposes) you can withdraw that consent and we must immediately stop processing your data. Please note that up to that point, we’re acting lawfully with your consent, withdrawal of consent cannot be backdated.  You have the right to request a copy of all personal data we hold relating to you and we must provide this within 30 days. You also have the right to require us to correct any records that are wrong.  You have the right to require us to erase personal data and we must comply unless we need it for one of the purposes described above (for example, if we hold a live contract for you). We also retain the right to keep data that is needed to establish, exercise, or defend a legal claim.  Where we process your data based on a ‘legitimate interest’ (underlined in the section on Purpose and Lawful basis, above) you still have the right to object to our processing of that data. From that point, we must stop processing your data until we have determined whether your rights override our interests.  Finally, you may have the right to have your personal data transferred to another organisation and we’re obliged to provide it to you in a clear and reasonable format.

 

OTHER PURPOSES FOR PROCESSING PERSONAL DATA
We don’t process your personal data for any other purpose than we’ve described here. We won’t
sell your personal data to other companies.  As we develop our services, we might add a new data process to our platform that uses your personal information. Should we decide that we want to develop a new processing purpose, we will contact you to let you know what we intend to do, the lawful basis we will use, and your rights over our intended new processing.

 

OUR CONTRACTUAL REQUIREMENTS TO USE YOUR PERSONAL DATA
If you’re a BookSource client or supplier, it’s a requirement that we collect personal information
from you so that we can enter into a contract with your company.

 

YOUR RIGHT TO LODGE A COMPLAINT WITH THE REGULATOR

At all times, you have the right to report a concern or lodge a complaint with the Information

Commissioner’s Office. Please refer to the ICO at https://ico.org.uk or by calling them on 0303 123
1113.  Of course, we hope that we can resolve your issue quickly and fairly – you can contact us at
enquries@booksource.net.