Privacy

WESTKAB ebook shop

This notice also covers the English shop on westkab.com and the German shop on westkab.de. The controller is Esther Biegemeier, sole trader trading as WESTKAB, at the address above. Public sales have not started. The following explains the planned purchase and delivery process; sandbox tests already use the payment and email services described below with the details supplied by the tester.

Orders and digital delivery

To prepare and fulfil an order, provide downloads, handle support and process refunds, we process the buyer’s name and email address, selected book and language, order reference, purchase time, price, currency, tax and payment status. We may receive billing and country information from Paddle where needed for the transaction or support. Download access uses access tokens; delivery records link the ordered files to the order. Our server also processes technical request data when a download is requested.

The legal basis is Article 6(1)(b) GDPR for the requested order and delivery services, Article 6(1)(c) for applicable legal record-keeping duties, and Article 6(1)(f) for secure delivery, fraud prevention and resolving disputes. Required order details are necessary to deliver the purchase; without them we cannot provide the personalised files or delivery messages. We do not use book purchases to create profiles of religious beliefs or make automated decisions with legal or similarly significant effects.

Paddle checkout and payment

When sales are enabled, Paddle acts as the authorised reseller and merchant of record. The Paddle entity identified at checkout handles the purchase, payment, applicable taxes and transaction receipt as an independent controller. Opening checkout connects your browser to Paddle and its payment services, which process the information you provide and technical data such as your IP address and device/browser information for payment, security and fraud prevention. WESTKAB does not receive your full card number or card security code.

We transmit information needed to associate the checkout with the selected product and receive payment confirmations and transaction information to verify payment, fulfil the order and handle support or refunds. Paddle determines the legal bases and retention periods for its own processing. Its entities, recipients, international transfers and safeguards, and privacy contact are explained in the Paddle Privacy Policy. Paddle’s processing may take place outside the European Economic Area; its policy explains the applicable adequacy decisions or contractual safeguards.

Personalised PDF and EPUB files

The buyer’s name, email address and purchase date are embedded in the PDF and EPUB as a personal licence notice. We use these details to supply the personalised edition described on the product and sales pages (Article 6(1)(b) GDPR) and to help protect against unauthorised distribution (Article 6(1)(f) GDPR). Source books and generated files are stored in private server storage. Access to generated files is controlled through the delivery system.

Anyone to whom you give a personalised file can read its licence notice. Please do not publish the file or share its download link. Personalisation itself does not remove your statutory consumer rights. Files you download remain on your own device until you delete them; deleting server-side records cannot remove copies already downloaded by you or shared with others.

Transactional email through Brevo

We use Brevo to send service messages, including order and download notifications, account messages where applicable, support-related messages and test messages requested by an administrator. Brevo receives the recipient’s email address, any name and order information included in the message, the message content and delivery information. Messages containing download links therefore also make those links available to the mail service and the recipient’s mail provider. Sending and delivery logs may contain message identifiers, timestamps, delivery status and failure information.

Brevo processes these data on our behalf for email delivery. The legal basis is Article 6(1)(b) GDPR for necessary order-related messages and Article 6(1)(f) for reliable service communication, delivery diagnostics and administration. A purchase does not automatically subscribe you to a newsletter. Provider and subprocessor details, international processing and applicable transfer safeguards are described in Brevo’s privacy information and its terms and data processing provisions.

Storage periods and access

We keep order and delivery information for as long as needed to fulfil the purchase, provide agreed download access and support, and deal with refunds or disputes. Records subject to tax or commercial retention duties are retained for the applicable statutory period; other data are deleted when their purpose ends. We retain generated files and access records only while needed for delivery, replacement downloads or resolving a specific issue. Security and mail delivery logs are retained as needed for operation and troubleshooting, subject to the providers’ retention settings. Sandbox records are kept while needed to verify the test and resolve related faults.

Access is limited to authorised administration and the providers needed to host the shop, process payment and deliver email. Paddle retains its own records under its own policy. To request access, correction or deletion of WESTKAB records, contact space@westkab.com; if a legal retention duty prevents deletion, we will explain the restriction. You may object to processing based on Article 6(1)(f) GDPR for reasons relating to your particular situation.