Privacy policy

• I collect only what you give me: your name and email when you join the mailing list, and your message when you get in touch.
• There are no analytics, advertising or tracking cookies on this site.
• I never sell your data or share it for anyone else’s marketing.
• You can unsubscribe from emails at any time, and ask me to see, correct or delete what I hold.

The waitlist and mailing list

When you join the waitlist or tick a box to receive book news, I collect your first name and email address, which list you chose (the Excursion Through Time waitlist, and optionally news about KEON and the folklore stories), and when and how you signed up. Kit, the email service I use, also records whether emails are delivered, opened and clicked, so I can see whether they reach you and stop sending to addresses that bounce.

Lawful basis: your consent (UK GDPR Article 6(1)(a)), which you give by ticking the box and confirming your address. You can withdraw it at any time with the unsubscribe link in every email, or by contacting me.

The contact form

When you send a message I receive your first name, last name if you give it, email address, subject and message. An automatic acknowledgement is sent to the address you entered. If you tick the optional mailing list box, I add you to the list as described above; otherwise your details are used only to reply.

Lawful basis: my legitimate interest in reading and replying to enquiries (Article 6(1)(f)). Where you contact me about a possible agreement, such as a speaking booking or rights enquiry, also the steps needed before entering into a contract (Article 6(1)(b)).

Spam protection on the contact form

The contact form uses Google reCAPTCHA v3 to tell people from automated spam. It loads only once you start filling in the form. reCAPTCHA collects information such as your IP address, browser and device details and how you interact with the page, and sends it to Google, which returns a score. A very low score can stop a message from being sent; if that happens to you, email me instead. Google processes this information under its Privacy Policy and Terms of Service.

Lawful basis: my legitimate interest in keeping the form, and my inbox, free of spam and abuse (Article 6(1)(f)).

Visiting the website

Like any website, the servers that deliver these pages record technical information about each request: your IP address, the page or file requested, the date and time, and your browser type. My hosting provider uses these logs to deliver the site and protect it from attacks. I don’t use them to identify or profile visitors.

Lawful basis: legitimate interests in running a secure, working website (Article 6(1)(f)).

I use a small number of service providers who process personal data on my behalf, under contracts that require them to keep it secure and use it only as I instruct:

• Kit (formerly ConvertKit, USA) sends the mailing list emails and stores subscribers.
• Netlify (Netlify, Inc., USA) hosts the website and runs the code that handles the forms.
• Google (Google LLC, USA, and Google Ireland Ltd) provides the email account that receives contact form messages, and reCAPTCHA.

I may also disclose information if the law requires it, for example to comply with a court order, or to protect the rights and safety of others.

Kit, Netlify and Google store or process data in the United States. Where personal data leaves the UK, it is protected by a recognised safeguard: the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it, or the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses in the provider’s data processing terms. You can ask me for more detail about these safeguards.

• Mailing list: until you unsubscribe or ask me to delete your details. After you unsubscribe, Kit keeps your email address on a suppression list so you are not emailed again.
• Contact messages: for up to 24 months after our last exchange, then deleted, unless a longer period is needed for an ongoing agreement or a legal claim.
• Server logs: for the short period my hosting provider keeps them for security and troubleshooting.

Under UK data protection law you have the right to:

• ask for a copy of the personal data I hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how I use it, including objecting to processing based on legitimate interests;
• receive data you gave me in a portable format;
• withdraw consent at any time, without affecting anything done before you withdrew it.

To use any of these rights, email inquiries@jeromemccavewrites.com or use the contact form. There is no charge, and I will reply within one month. I may need to confirm your identity first, usually by replying from the email address in question.

If you are unhappy with how I have handled your data, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

The site is served over an encrypted connection (HTTPS), forms are processed by server-side functions rather than in your browser, the secret keys for the services above are never sent to your browser, and I keep the personal data I hold to the minimum I need. No method of transmission over the internet is completely secure, but I take reasonable steps to protect your data.

This site is not aimed at children under 13, and I do not knowingly collect their data. If you are under 13, please ask a parent or guardian to sign up for you. If you believe a child has given me their details, contact me and I will delete them.

The site uses no analytics or advertising cookies. The small amount of storage it does use is explained in the cookie policy.

I will update this policy if the way I handle data changes, and change the date at the top of the page. If a change is significant and affects mailing list subscribers, I will tell them by email.