Privacy Policy
Last updated: 20 October 2026
1. About this Privacy Policy
This policy explains how Books By People Ltd handles personal information about publishing-house representatives, authors, editors, people named in submitted materials and visitors to our public certification pages.
It describes the information we collect, how submitted documents are handled, how long records are kept and how certification analyses support human decisions.
This policy is a transparency notice under data protection law. It is not a contract.
2. Who we are
Books By People Ltd is the controller of the personal information described in this policy.
Books By People Ltd
Company number 16625520
Heaslands, Steep Road
Crowborough, England, TN6 3RX
Privacy questions, requests and complaints go to info@booksbypeople.org.
3. Scope
This policy covers:
the Books By People platform used by publishing houses;
the author and editor declaration pages reached by a secure link;
the public certification directory and the ISBN verification pages;
the emails we send in connection with the above.
Certification itself is governed by the Regulations Governing the Use of the Books By People Certification Mark. The Regulations say what certification means and how it is decided. This policy says how we handle personal information while doing it.
4. Who this policy applies to
Publishing house staff with an account: administrators, directors and editors.
Authors, who have no account and complete their declaration through a secure link.
Editors, who complete and sign an editor’s declaration.
People named inside documents sent to us, including names a file records in its own properties.
Books By People staff using the platform.
Visitors to our public directory and verification pages.
Authors are not users of our platform. There is no author account, login or dashboard, and we do not create one.
5. Personal information we collect
Account and profile. For platform account holders, we collect names, email addresses, optional job titles, telephone numbers and profile pictures, together with roles, publishing-house affiliations and account status.
Publishing house. Name and registered name, company registration number, website, contact email and telephone, address, country and city, year established, a description, and the languages and categories it publishes in. For a sole trader or a very small house, some of this may also be personal information about an individual.
Written work. Title and subtitle, language, genre, word count, and the answers given about whether the work falls within the Scheme.
Author records. The author’s name, an email address where one is given, and any biography or notes the publishing house records. Houses are asked not to record sensitive personal information in free-text notes.
Declarations. The answers given in the author’s and the editor’s declarations, the questionnaire version they were answered against, the name typed to confirm or sign, and the date and time.
Manuscripts and supporting material. The manuscript files and development drafts, and any supporting material attached. For each file we record the filename, type, size, a SHA-256 digest of its contents, the word count read from it, who uploaded it and when.
Information read out of documents. When we analyse a file we read the properties it carries about itself. These can include the name recorded as its creator, the name recorded as having last saved it, and names attached to tracked changes. We do not treat a name recorded in a file as proof that the person wrote it.
Google Drive imports. Where a publishing house selects a document for import, we record the document and available provenance information, such as identifiers, timestamps, ownership, revisions and summary comment activity. We do not request comment text.
Correspondence. We process clarifications, Enhanced Review exchanges, enquiries received from publishing houses or other contacts, and related service emails.
Certification records. Analysis results, compliance reports, the certification decision and its reasoning, and the certification’s status over time.
Technical and security. An activity trail recording who did what and when, and counters limiting how often sign-in can be attempted from one internet address.
We do not store IP addresses or browser user-agent strings. Our sign-in limits work from a one-way cryptographic transformation of the address, so those records cannot be read as a list of who visited from where.
6. Where we obtain information
Source | Information received |
|---|---|
Platform account holders | Profile details, account information and enquiries submitted through the platform |
Publishing houses | Work and publication details, author/editor contact details, manuscripts, drafts and supporting evidence |
Authors and editors | Declarations, confirmations and correspondence provided directly through authorised channels |
Submitted documents | Document content, file properties, creator and revision metadata |
Selected Google Drive imports | Selected documents and available provenance information provided through the import |
Books By People systems | Analysis results, certification records, activity logs and service-message records |
Information about authors and editors may be supplied by the relevant publishing house rather than collected directly from them. Authors receive privacy information with their declaration link. Sections 22 and 23 describe individuals’ rights and how to make a request.
7. How and why we use personal information
To give people secure access to the platform; to send sign-in codes and invitations; to record works, authors, editors and publication details; to obtain author and editor declarations; to receive, store and analyse manuscripts and development drafts for Compliance Review; to produce the Combined Compliance Report used in the certification procedure; to ask for clarification and, where the Regulations require it, conduct Enhanced Review; to reach and record the certification decision; to maintain the registers and records the Regulations require of us; to publish certification status so that a reader, bookseller or librarian can verify a book; to keep an accurate record of what happened on each case; to protect the platform against abuse; and to answer enquiries and complaints.
8. Lawful bases
We process personal data mainly on the basis of legitimate interests: securing platform accounts, managing certification applications, obtaining declarations, analysing evidence, reaching and recording determinations, maintaining an auditable certification register, enabling public verification, and responding to enquiries. We assess these interests against the rights and interests of the people affected.
Where another lawful basis applies to a specific activity, we will identify and use that basis as required by law. We do not treat an author’s agreement to certification through their publisher as blanket consent for all personal-data processing.
Individuals whose personal information we process may object to processing based on legitimate interests and request information about our balancing assessment. We assess each request on its facts, including whether certification records must be retained.
9. Certification-related information
A certification case brings together the work’s details, the author and editor declarations, the manuscript and development drafts, any supporting material, our analyses, any clarifications or Enhanced Review, and the decision.
When a case is opened, the publishing house hands it to us and we can read it. When the house submits the case files, our review begins. Both are deliberate acts by the house.
Certification applies to an individual written work. A refusal is kept as well as an approval: a certification body that discarded its refusals could not show that it applied the same standard to everyone.
10. Manuscripts, drafts and document metadata
Manuscript files, development drafts and supporting documents are deleted from private file storage when a certification case closes, whether following a final determination, an eligible publisher withdrawal or an authorised Books By People administrative closure.
Once deletion is completed, manuscript files cannot be recovered through our storage or database backup systems.
11. Declarations and certification evidence
Declarations are permanent records. Once completed, a declaration is never edited or deleted. Where the scheme allows a correction, it is recorded as a new declaration alongside the original, which stays exactly as it was.
Authors receive a personal declaration link by email. The link is a confidential credential and should not be forwarded.
Communications concerning certification cases are generally handled through the publishing house. Authors may also contact Books By People directly at submissions@booksbypeople.org.
12. Software-assisted analysis and human review
We use software to examine evidence of how a work came to be written and to prepare analysis results. The focus is on that evidence rather than on detection of AI. The analysis produces evidence considered under the certification procedure.
We do not use submitted manuscripts, drafts, declarations or certification evidence to train, fine-tune or develop AI models, and we do not send manuscript content to external AI services.
Certification determinations are made by Books By People under the Certification Regulations.
13. Enhanced Review
Enhanced Review is a formal escalation under the Regulations, conducted only where a specified concern arises. We tell the publishing house what the concern is and invite a response, and we consider any response before a final determination.
Where the concern is about an author’s identity or existence, the Regulations limit us to asking for information already on public record, or confirmation from the publishing house based on its own dealings with the author.
We do not routinely ask for further explanatory materials. We ask only where a written explanation cannot resolve the concern and the publishing house agrees to provide it. Anything provided is deleted with the rest of the case’s files when the case closes.
14. Communications and transactional email
We send service messages such as sign-in codes, invitations, declaration links, case updates, review notices and replies to enquiries. We use Postmark (AC PM LLC, part of ActiveCampaign) to deliver transactional emails.
We do not send marketing emails or use email open or click tracking. Emails generally contain only the information needed to identify the requested action; sensitive case details are made available in the platform rather than the message itself. We retain necessary delivery and communication records.
15. Technicaland account information
We maintain access and activity records to protect the platform and demonstrate how certification cases were handled. These records can identify who performed significant actions and when. Access is restricted according to role, and audit corrections are recorded without concealing the original event.
We also use security controls to help prevent misuse of sign-in codes and unauthorised access.
16. Cookies and similar technologies
We use a strictly necessary authentication cookie and limited browser storage to keep sessions secure and preserve an unfinished declaration within the browser. We do not use advertising cookies or third-party marketing trackers.
Strictly necessary technologies do not require an optional cookie-consent banner. If non-essential tracking is introduced, we will update this policy and apply the appropriate consent requirements.
17. Who we share information with
Within a publishing house: colleagues at that house, according to their role. No house can see another house’s information.
Books By People staff: Certification Approvers see case material in order to review it; system administrators have access in order to run the platform.
Infrastructure providers: the platform runs on infrastructure we control, operated under contract and bound by confidentiality. See section 18.
Publicly: only the information described in section 19.
Where the law requires it, or to establish, exercise or defend legal claims.
We do not sell personal information and we do not share it for anyone else’s marketing.
If our business is transferred, information may transfer with it. The certification records would need to, because the Certification Mark and its registers cannot be separated from the records behind them.
18. Service providers
The platform runs on infrastructure operated under contract and bound by confidentiality, including Google Cloud for hosting and storage and Postmark (AC PM LLC) for transactional email. Manuscript content is not sent to any other third party.
Where a publisher chooses to import a document from Google Drive, that import is initiated using the publisher’s own Google account. We receive the selected document and relevant provenance information needed for certification. We do not use Drive to access unrelated files.
19. What appears publicly
ISBN verification. Anyone with the verification link or the ISBN can see the work’s title, the author names as published, the publishing house and imprint, the ISBN, format, publication date and edition, and the certification’s public identifier, scheme, status and date. A suspended or withdrawn certification still resolves, showing its current standing, because that is precisely what somebody verifying a book needs to see. Nothing about a case in progress is disclosed.
Publisher directory. Where a publishing house’s record has been approved and the house has been listed, its page shows the organisation’s name, logo, description, membership status and the date it joined, together with a list of that house’s certified works. Each entry shows the title and the author names as published, which already appear on the book itself. These pages are public.
Both the directory and the individual certification records are published at certifications.booksbypeople.org.
20. International transfers
Our service providers may process or access personal data outside the United Kingdom, including in the European Economic Area and the United States. Where UK data protection law requires safeguards for an international transfer, we rely on an applicable adequacy arrangement or appropriate contractual safeguards, such as the UK Addendum to the Standard Contractual Clauses.
Postmark is a US-based provider. Further information about relevant providers and transfer safeguards can be requested at info@booksbypeople.org. We review transfer arrangements when providers or processing arrangements change.
21. How long we keep information
Manuscripts, drafts and supporting-file contents: retained only while a certification case remains open and deleted from private file storage when the case closes. We do not retain separate manuscript backups or recoverable deleted versions. Certification records and file metadata are retained separately as described below.
Certification and audit records: decisions and reasons, completed declarations, analysis and compliance results, relevant file metadata and digests, changes to certification status, and case activity/closure history are retained for the long term. They support the integrity and traceability of the Certification Mark and may be needed to establish or defend legal claims. We periodically review whether continued retention of each category is necessary; long-term retention does not mean every record is exempt from data protection rights.
Accounts, correspondence and security records: retained only for as long as reasonably necessary for the relevant service, security, administrative or legal purpose, subject to applicable retention rules. Short-lived authentication codes expire automatically.
Ending platform access does not delete records of certification activity already carried out.
22. Data protection rights
Individuals whose personal data we process may request access, correction, erasure in applicable circumstances, restriction of processing, or object to processing based on legitimate interests. These rights are subject to the conditions and exceptions in data protection law.
There is no automated decision-making of the kind that carries additional rights (section 12).
Some information may need to be retained as part of certification evidence even after an objection or erasure request. We assess each request individually and explain any legal reason for retaining information. Corrections to completed declarations and audit records are documented without silently overwriting the original record.
23. Making a data protection request
Data protection requests can be sent to info@booksbypeople.org. Please include enough information for Books By People to locate the relevant records and respond securely.
We respond without undue delay and normally within one month. Where permitted for complex requests, the period may be extended by up to two additional months, with notice during the first month. Searches are reasonable and proportionate.
Authors and editors should contact their publishing house about the publishing relationship or the book outside the certification process. Books By People handles requests relating to personal data for which it is responsible.
24. Complaints
Privacy complaints can be sent to info@booksbypeople.org. We will acknowledge complaints within 30 days, investigate and explain the outcome.
You can also complain to the Information Commissioner’s Office at any time, although the ICO asks that you raise the matter with us first.
Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
0303 123 1113 - ico.org.uk
25. Children
The platform is a business tool for publishing professionals and is not directed at children. Authors are reached through their publishing house. We do not knowingly create accounts for children.
26. Changes to this policy
This policy is updated when our data-processing practices change. We provide notice to affected individuals where a material change requires it.
27. Contact
Books By People Ltd
Heaslands, Steep Road
Crowborough, England, TN6 3RX
Company number 16625520