Privacy Notice · Thomas Ludlow

This is a small website for two books. It sets no cookies, runs no forms and keeps no list of readers. In practice there is very little to tell you — but the law says I should tell you plainly, so here it is.

Who is responsible

Thomas Ludlow is the pen name of the author of Nothing Stops at Crouch End Now and Mind the Dark: Twelve London Thrillers. The author is the data controller for this website for the purposes of the UK GDPR and the Data Protection Act 2018.

The easiest way to reach the controller is by email, athello@thomasludlow.com. That address is monitored by the author. This site does not sell anything directly and is not operated by a company, so there is no company number or trading address to give you.

What is collected

One thing, and it does not identify you: ordinary web server records. Like every website, the server that delivers these pages briefly processes the technical details of each request so that it can answer it and keep the site secure. Those records are short-lived, are held by the hosting provider as part of delivering the site, and are not used to build a picture of you.

What is not collected

There is no newsletter sign-up on this site, no contact form, no comment box, no search box that records what you typed, no account to create and no order to place. There is nowhere on this site to give me your name, your email address, your postal address or your payment details, and so none of those things are held.

No cookies are set by this site. See the cookie notice.
No analytics product is used, and no measurement or counting code is served with these pages. Your visit is not tallied anywhere.
No advertising, remarketing or social media tracking pixels are used.
No device fingerprinting, and no profiling or automated decision-making.
Nothing is stored in your browser to recognise you on a later visit.
Your data is never sold, rented or shared for marketing.

If you email me

If you write to hello@thomasludlow.com, I will hold your email address and whatever you chose to put in your message for as long as it takes to reply and to keep a sensible record of the exchange. Email is handled by an ordinary commercial email provider. I will not add you to any list because you wrote to me, and I will not pass your message on to anyone else unless you ask me to or the law requires it.

There isn't one. No mailing list exists, and no email addresses are held for marketing. If a newsletter is started later, it will be opt-in, it will run on consent, every message will carry a one-click unsubscribe link, and this notice will be rewritten to describe it before the first email is sent.

Links to retailers and other sites

Every "buy" link on this site points outwards to a retailer — in practice Amazon — through the buy page. Once you follow one of those links you are on the retailer's website, and the retailer's own privacy notice, terms and cookies apply to what happens there. I have no control over them, I receive no personal data back from them, and I cannot see what you bought or whether you bought anything at all.

The same goes for any other external site linked from these pages. Linking to a site is not an endorsement of how it handles your data.

Lawful basis for processing

Where any processing does take place, the lawful basis is:

Legitimate interests (Article 6(1)(f) UK GDPR) for keeping the site available and secure. The privacy impact is minimal precisely because nothing identifying is stored, and you can object at any time.
Legitimate interests (Article 6(1)(f) UK GDPR) for replying to an email you have chosen to send me.
Consent (Article 6(1)(a) UK GDPR) for any future mailing list, which does not yet exist.

No special category data is processed, and none is asked for. Please don't send any in an email.

The site is a set of static pages hosted on Firebase Hosting, a service of Google LLC, and email is delivered by an email provider. Those providers act as processors: they handle the technical plumbing on my instructions and are not permitted to use anything for their own purposes. Beyond them, nothing is shared with anyone, other than where I am obliged to disclose something by law.

Google serves these pages from a content delivery network with locations around the world, so a page normally reaches you from whichever location is nearest, and the short-lived server records described above may be handled outside the UK. Where a provider processes data outside the UK, that transfer relies on UK adequacy regulations — including the UK Extension to the EU–US Data Privacy Framework, where the provider is certified under it — or on the International Data Transfer Agreement or Addendum, as applicable.

How long anything is kept

Server records are kept only for the short period the hosting provider needs for delivery, diagnostics and security, and are then deleted or overwritten in the ordinary course.
Emails are kept for as long as the correspondence is useful, and are deleted when it is not — normally within two years, sooner if you ask.

Your rights

Under the UK GDPR you have the right to be informed, and the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing carried out on the basis of legitimate interests. You also have the right not to be subject to solely automated decision-making, which this site does not carry out.

In practice, the only personal data I am ever likely to hold about you is an email you sent me. To exercise any of these rights, write tohello@thomasludlow.com and say what you would like done. There is no charge, and I will respond within one month. I may need to ask a question or two to be confident I am speaking to the right person — and if I genuinely hold nothing about you, I will simply tell you that.

Complaining to the ICO

If you think this site has handled your data badly, please tell me first so that I can put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint or on their helpline, 0303 123 1113. Complaining to the ICO does not affect any other legal remedy you may have.

Children

These are adult thrillers, and the site is not directed at children. No personal data is knowingly collected from anyone, of any age.

Changes to this notice

If what the site does changes, this notice changes first — before the new behaviour goes live, not afterwards. That includes measurement: if any kind of analytics is ever added, it will be described here before it is switched on, and consent will be asked for where the law requires it. The date at the top of the page always reflects the current version.

This notice is written in plain English so that it is actually readable. It is a description of how this website behaves, not legal advice, and it is not a substitute for advice on your own circumstances.