Legal
Privacy policy
Last updated 23 September 2026
This policy explains what personal data Pen Tribune collects, why we collect it and what rights you have. It applies to this website and to any enquiry, submission or project you bring to us.
Who we are
Pen Tribune is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You can contact us about anything in this policy at hello@pentribune.com.
What we collect and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| Your name, email address and the contents of your enquiry, including any synopsis or sample you send | To read your enquiry or submission and to reply to you | Legitimate interests (Article 6(1)(f) UK GDPR): answering people who write to us |
| Project details, manuscripts, correspondence and billing details for authors who commission services | To quote for and carry out the work you asked for, and to invoice for it | Contract (Article 6(1)(b) UK GDPR) |
| Invoices and payment records | To keep the business and tax records the law requires | Legal obligation (Article 6(1)(c) UK GDPR) |
| Technical data such as IP address, browser type and the pages requested | To deliver the website, keep it secure and stop abuse of the enquiry form | Legitimate interests (Article 6(1)(f) UK GDPR): running a secure website |
We do not use your data for advertising, we do not sell it, and we do not make decisions about you by automated means. We do not send marketing email.
Manuscripts and creative work
Anything you send us is read in confidence and used only for the purpose you sent it for. We do not share your manuscript with anyone outside Pen Tribune without your permission, except with a freelance editor or designer working on your project under a confidentiality obligation, and only once you have agreed to that project.
Who we share data with
We use a small number of service providers who process data on our behalf and under our instructions:
- Vercel Inc., which hosts this website and processes the technical data needed to deliver it;
- Resend, which delivers the messages sent through our enquiry form to our inbox;
- our email provider, which stores the correspondence we exchange with you.
Some of these providers are based in the United States or store data there. Where personal data leaves the United Kingdom, we rely on the safeguards set out in each provider's data processing terms, such as the UK International Data Transfer Addendum to the European Commission's standard contractual clauses or an adequacy decision under UK law. We may also disclose data where the law requires it.
How long we keep it
- Enquiries and submissions that do not lead to a project: up to 24 months from our last exchange, then deleted.
- Project files and correspondence: for the length of the project and up to 24 months after it ends, so we can help with later editions.
- Invoices and payment records: for at least five years after the 31 January submission deadline of the relevant tax year, as HMRC requires.
- Server logs held by our host: for the short period set by the host's own retention policy.
You can ask us to delete your enquiry or manuscript at any time, unless we must keep a record by law.
Your rights
Under data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how we use your data;
- object to our use of your data where we rely on legitimate interests;
- receive data you gave us in a portable format, where we rely on contract.
To use any of these rights, write to hello@pentribune.com. We will reply within one month. There is no charge in most cases.
Complaints
If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner's Office atico.org.uk/make-a-complaint.
Children
This website and our services are intended for adults. We publish books for young readers, but we do not knowingly collect personal data from children. A parent or guardian should contact us on behalf of anyone under 18.
Security
The site is served only over an encrypted connection. The enquiry form is checked on our server, and access to correspondence and manuscripts is limited to the people who need it for your project.
Cookies
Our cookie policy explains the small amount of browser storage this site uses.
Changes to this policy
We will update this page when our practices change and show the date of the latest version at the top.