Privacy
Privacy policy
Last updated: 28 October 2026
This policy explains how Twenty Squares Publishing uses personal information through our website, reader communications and publishing activities. It also covers our imprints, Shira Island Music and Goldberry Hill.
Information we collect and use
Enquiries: When you contact us, we receive your email address, any name you provide and the information in your message. We use this to respond and deal with your enquiry.
Our lawful basis is our legitimate interest in answering correspondence and running our publishing business.
Reader subscriptions and review teams: When you sign up, we collect the details requested on the form, usually your name and email address. You may provide these directly or through a Facebook or Instagram sign-up form.
We use your details to send the book or information requested and the communications described when you joined. Review-team emails may include helpful guidance and optional invitations to leave an honest review. Reviewing is not a condition of keeping your free book.
We rely on consent for these email subscriptions. We only send ongoing emails about future books where you have agreed to receive them. You can unsubscribe at any time using the link in our emails or by contacting us.
Our review teams are for adults aged 18 and over.
Email activity: MailerLite records which links in our emails are clicked. This helps us see which resources are useful.
Website visits: Cloudflare processes technical information, such as IP addresses and request details, to deliver and protect our website. Our lawful basis is our legitimate interest in providing a secure, functioning website.
Cookies and external links
We do not use website analytics, advertising pixels or non-essential tracking cookies. Our hosting provider may use necessary security technologies to protect the site.
Free books are available through public Google Drive download links, without registration. Google processes visits to its service under its own privacy policy.
Links to Amazon and other external services take you to websites with their own privacy arrangements.
Service providers
We use:
- Cloudflare for website hosting and security.
- MailerLite for subscriber records, email delivery and email activity measurement.
- Microsoft 365 for email correspondence.
- Meta for details submitted through Facebook and Instagram sign-up forms.
These services receive information relevant to their role. Meta also processes information independently when you use its platforms.
We do not upload our subscriber list to Google Drive to provide book downloads.
We do not sell or rent personal information. We may disclose information where legally required or where necessary to establish, exercise or defend legal claims.
International processing
Our providers may process information in the UK, the European Economic Area, the United States and other countries where they or their service providers operate.
MailerLite’s data processing agreement includes standard contractual clauses and the UK Addendum for relevant international transfers. Cloudflare’s agreement provides for Data Privacy Framework arrangements and standard contractual clauses with the UK Addendum where applicable.
Microsoft’s processing of our correspondence is governed by the international-transfer provisions in its applicable Microsoft 365 data protection terms. Meta explains its international processing and safeguards in its privacy policy.
Contact us for further information about the safeguards applicable to your information and how to obtain a copy.
Keeping your information
We retain information according to the purpose for which it was collected:
- Enquiries: until the enquiry and any resulting action are complete, unless the correspondence is needed as a relevant business record or for a legal claim.
- Review teams: while delivering and administering the relevant book’s email programme and resolving outstanding queries. Afterwards, we delete or anonymise records no longer needed, unless you separately subscribed to ongoing emails.
- Subscriptions: while you remain subscribed. We review inactive records and remove information no longer needed for the subscription.
- Unsubscribe records: we retain the minimum information needed to respect your preference and avoid sending further marketing.
- Technical logs and backups: these follow the applicable providers’ retention and deletion arrangements.
Your rights
Depending on the circumstances, you can ask to access, correct or delete your information, restrict its use, object to processing, or receive certain information in a portable format.
You can object to direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing.
Email us to make a request. We normally respond within one month, subject to applicable legal exceptions. We may need to confirm your identity.
We do not use your information to make solely automated decisions that have legal or similarly significant effects on you.
Contact and complaints
The data controller is Nicola Young, trading as Twenty Squares Publishing, including its imprints Shira Island Music and Goldberry Hill.
Email: [email protected]
Business correspondence address: Huntly House, Millport, Isle of Cumbrae, KA28 0DZ, Scotland.
If you are unhappy with our handling of your information, please email us. We will acknowledge your complaint within 30 days, investigate without undue delay and tell you the outcome.
If you remain dissatisfied, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or telephone 0303 123 1113.
Updates
We update this policy when our practices change. The date above shows the latest revision.