Privacy Policy

This policy explains what personal data is collected when you visit this website or buy The Architecture of Consent, why, who it is shared with, and the rights you have. We collect as little as possible.

• 1. Who is responsible
• 2. Visiting the website
• 3. Buying a book
• 4. Who receives your data
• 5. Transfers outside the EU
• 6. How long data is kept
• 7. Your rights
• 8. Other points
• 9. Contact

1. Who is responsible

The data controller for this website and for book sales is:

Questions about your data go to the contact above.

2. Visiting the website

Server logs

When you open any web page, your browser sends technical information to the server that hosts it. Our hosting provider, Cloudflare, Inc., automatically records this in short-lived server logs: your IP address, the date and time, the page requested, your browser type and the referring page. This is needed to deliver the site and keep it secure, and is not used to identify you.

Legal basis: our legitimate interest in running a secure website (GDPR Art. 6(1)(f)).

Cookies and local storage

This website sets no cookies and uses no analytics, tracking or advertising tools. It stores only your cookie-banner choice in your browser. Full details are in the Cookie Policy.

Fonts and images

All fonts and images are served from this website itself. Your browser does not contact Google Fonts or any other third-party service when you visit.

3. Buying a book

Payments are handled by Stripe. When you click a buy button you leave this website and enter your details on Stripe’s secure checkout page. Your card details go directly to Stripe and are never seen or stored by us.

We do not send marketing emails. If that ever changes, it will only be with your separate, explicit consent.

4. Who receives your data

We never sell or rent personal data. It is shared only with the service providers we need to run the site and the shop:

• Stripe — payment processing and fraud prevention. For customers in the EEA, payments are processed by Stripe Payments Europe, Ltd. (Ireland). See Stripe’s privacy policy.
• Cloudflare, Inc. — website hosting, content delivery and security (for example, blocking malicious traffic). See Cloudflare’s privacy policy.
• Tax and accounting advisers or authorities — only where the law requires it.

5. Transfers outside the EU

The seller is based in the United States, and Stripe and Cloudflare may process data in the United States and other countries. Where data leaves the European Economic Area, these providers rely on recognised safeguards such as the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses. Details are in their privacy policies.

6. How long data is kept

• Server logs: deleted automatically by the hosting provider, usually within a few weeks.
• Order and payment records: kept for as long as tax and accounting law requires, then deleted.
• Emails you send us: kept until your question is resolved, unless they form part of an order record.
• Cookie-banner choice: stored in your own browser for 12 months.

7. Your rights

Under the GDPR and similar laws you have the right to:

• Access the personal data we hold about you and get a copy;
• Correct data that is wrong or incomplete;
• Delete your data, unless we must keep it by law;
• Restrict how your data is used;
• Data portability: receive your data in a common, machine-readable format;
• Object to processing based on our legitimate interests;
• Withdraw consent at any time, where processing is based on consent;
• Complain to a data protection supervisory authority, in particular in the country where you live or work.

To use any of these rights, email the contact in section 9. We will reply within one month.

8. Other points

• No decisions with legal effect are made about you by automated means, apart from Stripe’s fraud screening described above.
• This website is not directed at children under 16, and we do not knowingly collect their data.
• If this policy changes, the new version will be posted on this page with a new “last updated” date.

9. Contact

For any question about your data or this policy, write to oswinpuddifoot@gmail.com.