Who we are
BookedObsessed is a UK-based book subscription service. Our registered address is 123 Book Lane, London, EC1A 1BB. We are the data controller for information collected through this website. Contact us at privacy@bookedobsessed.co.uk with any data enquiries.
What data we collect
- Account data: name, email address, phone number (optional)
- Delivery data: UK postal address for shipping
- Reading preferences: genre preferences, hard-nos, and curation preferences you provide
- Order data: order history, subscription details, and delivery records
- Payment data: handled exclusively by Stripe. We never see or store card numbers. We hold only a Stripe customer ID.
- Community data: posts, comments, and reactions you make in the community forum
- Technical data: session tokens (HttpOnly cookies), IP address logs for security
Why we collect it (lawful basis)
- Contract performance: processing orders, delivering books, managing subscriptions
- Legitimate interests: fraud prevention, account security, service improvement
- Consent: marketing emails (you can withdraw at any time in Settings)
- Legal obligation: retaining financial records for 7 years per UK law
Payments & PCI DSS
All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment service provider. Card details are entered directly into Stripe's secure fields and never pass through our servers. We are therefore out of PCI DSS scope for cardholder data.
Your rights under UK GDPR
- Right of access: request a copy of your data via Settings → My Data → Export
- Right to erasure: delete your account via Settings → My Data → Delete Account. Personal data is anonymised; financial records are retained for legal compliance.
- Right to rectification: update your details in Settings → Account
- Right to restrict processing: contact us at privacy@bookedobsessed.co.uk
- Right to withdraw consent: opt out of marketing in Settings → Notifications
- Right to complain: you may lodge a complaint with the ICO at ico.org.uk
Cookies
We use only essential cookies: a secure HttpOnly session cookie for authentication. We do not use advertising or tracking cookies. Our cookie consent banner lets you acknowledge this.
Data retention
Account data is held until you delete your account. Order and financial records are retained for 7 years for legal compliance, anonymised upon account deletion. Email logs are purged after 90 days.