Privacy Policy & Data Protection Framework

1. Statutory Entity and Data Controller Information

This Privacy Notice governs the operational domain sortsptclipcottage.shop and all associated bibliographic reference services operated by Sortsptclip Cottage Library Ltd ("the Company", "we", "us", or "our").

The statutory data controller responsible for personal information processed through this website is:

2. Categories of Personal Data Collected

We operate under strict data minimization principles. We do not operate commercial consumer storefronts, collect credit card credentials, or sell individual user data to marketing aggregators. We process personal information solely within the following clear categories:

• Directly Provided Inscription Data: When you complete our contact or bibliographic query forms, we record your name, institutional affiliation, professional email address, subject of enquiry, and any specific queries submitted.
• Technical and Connection Telemetry: To guarantee website stability, security, and DNS load-balancing, our servers automatically log Internet Protocol (IP) addresses, browser user-agent strings, referral HTTP headers, timestamp parameters, and requested URLs.
• Client-Side Storage and Consent Records: We store your chosen cookie preferences in local client storage so that your consent parameters are honored across subsequent navigation sessions without repeated prompting.

3. Lawful Grounds for Processing (UK GDPR & EU GDPR)

Under Article 6 of the UK General Data Protection Regulation (UK GDPR), we process personal data exclusively under the following lawful justifications:

• Article 6(1)(b) — Contractual Performance and Pre-Contractual Requests: Processing required to evaluate and respond to patron requests for archival research, reading lists, or bibliographic additions.
• Article 6(1)(f) — Legitimate Interests: Processing essential for maintaining server infrastructure security, preventing denial-of-service exploits, and compiling aggregated server traffic metrics.
• Article 6(1)(a) — Explicit Consent: Where you opt in to non-essential analytical cookies via our consent prompt, processing is conducted on the basis of your freely given consent, which you can withdraw at any time.

4. Third-Party Processors and Hosting Infrastructure

We do not disclose, rent, or vend personal information to third-party brokers. We engage carefully vetted infrastructure sub-processors who adhere to strict data-processing agreements:

• Web Hosting and CDN Networks: Enterprise static delivery networks that provide encrypted HTTPS data transmission, localized DDoS mitigation, and edge caching.
• Institutional Mail Services: Secure SMTP mail delivery relays for transmitting institutional correspondence originating from our enquiry desk.
• Legal & Regulatory Authorities: We may disclose records where compelled by valid court orders from the English judiciary, law enforcement, or statutory UK authorities.

5. International Data Transfers

Where technical processing requires transferring data outside the United Kingdom or the European Economic Area (EEA), such transfers are conducted exclusively under approved UK International Data Transfer Agreements (IDTAs), European Commission Standard Contractual Clauses (SCCs), or to jurisdictions possessing an official adequacy decision by the UK Information Commissioner's Office (ICO).

6. Data Retention Schedules

Direct inquiries received through our contact desk are retained in our secure correspondence archives for up to twenty-four (24) months following the resolution of the query, after which records are securely redacted or deleted. Server access logs containing IP addresses are automatically purged on a rolling 30-day cycle unless active threat investigations require temporary retention.

7. Data Subject Rights (UK GDPR, EU GDPR & CCPA)

Depending on your legal jurisdiction, you possess enforceable statutory rights regarding your personal records:

• Right of Access (Subject Access Request): You have the right to request a complete copy of all personal records we hold regarding your identity.
• Right to Rectification: You may request the immediate correction of inaccurate or incomplete contact information.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your correspondence records where no compelling statutory ground mandates their continued retention.
• Right to Restriction and Objection: You may object to our processing based on legitimate interests or request temporary restriction during dispute investigations.
• Right to Non-Discrimination: Under the California Consumer Privacy Act (CCPA), you are entitled to exercise your privacy rights without experiencing disparate service levels or refusal of service.

To exercise any of these rights, transmit a formal request to our Data Protection Officer at [email protected]. We verify applicant identity and respond within thirty (30) calendar days as required by UK law.

8. Supervisory Authority and Complaints

If you believe your data has been handled in violation of UK data protection statutes, you maintain the statutory right to lodge a formal complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: +44 (0)303 123 1113 • Website: ico.org.uk