Global Privacy & Data Protection Notice

1. Data Controller & Data Processor Role Demarcation

Clarity regarding statutory data-protection roles is essential for publishing organisations managing thousands of authors, volume editors, peer reviewers, illustrators, and literary agents. Under the United Kingdom General Data Protection Regulation and Data Protection Act 2018 ("UK GDPR"), Regulation (EU) 2016/679 ("EU GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and UAE Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data ("UAE PDPL"), British Noble operates in two distinct capacities depending upon context.

British Noble as Data Controller (or "Business" under CCPA): British Noble acts as Data Controller solely with respect to: (a) visitors browsing britishnoble.com; (b) prospective customers submitting enquiries on /demo/, /free-trial/, or /contact/, or subscribing to The Publishing Operations Brief; (c) individual authors contracting directly with British Noble Press for bespoke book production; and (d) administrative billing, procurement, and security contacts at subscribing publishing houses.

British Noble as Data Processor (or "Service Provider" under CCPA): Whenever a subscribing publishing house, university press, or multi-imprint group uploads contributor biographies, ORCID/ISNI identifiers, peer-review assignments, Connected Author Portal user profiles, literary-agency splits, or payee tax and banking records into its workspace, that subscribing publisher remains the sole Data Controller. British Noble processes such workspace records strictly on the Controller's documented instructions pursuant to our Enterprise Data Processing Addendum. Individuals seeking to exercise rights over records held inside a specific publisher's workspace may contact that publisher directly or write to Privacy@BritishNoble.com for immediate routing to the relevant Controller.

2. Categories of Personal Data Collected & Explicit Exclusions

British Noble adheres strictly to the principle of data minimisation, collecting only structured attributes operationally required for publishing workflows, financial compliance, and workspace security:

• Workspace Identity & Authentication Data: Full name, professional work email address, organisation and imprint affiliation, SAML 2.0 NameID or OIDC subject identifier, role-based access scope, multi-factor authentication device metadata, and session timestamps.
• Bibliographic Contributor Metadata: Publicly intended author, editor, translator, illustrator, and narrator attribution records embedded in EDItEUR ONIX 3.1.2 feeds, including ORCID, ISNI, professional biographies, academic affiliations, and territory residency indicators where required by library catalogues.
• Royalty Payee & Statutory Tax Vault Records: Payee legal name, remittance postal address, encrypted IBAN/sort-code/routing coordinates, payment processor account tokens, and encrypted W-9, W-8BEN, W-8BEN-E, or self-billing VAT certificates required solely to calculate treaty withholding rates and execute author disbursements.
• Commercial & Support Communications: Enquiry submissions, sandbox provisioning preferences, architectural scoping notes, and customer support ticket transcripts.
• Security & First-Party Telemetry: IP-anonymised Core Web Vitals metrics (when consented), TLS handshake logs, cryptographic audit trails of permission changes and file downloads, and rate-limiting security telemetry.

Zero Special-Category Harvesting: British Noble does not request, infer, or harvest special categories of sensitive personal data (such as health records, biometric templates, religious beliefs, political opinions, genetic data, or Precise Geolocation). Where an autobiographical manuscript or academic monograph authored by a writer incidentally discusses historical or personal themes, that literary text is encrypted at rest as opaque Customer Content and is never parsed to build personal profiles.

3. Purposes of Processing & Statutory Lawful Bases Schedule

Every processing operation performed by British Noble as Data Controller is anchored to a documented lawful basis under Article 6 of the UK and EU GDPR and equivalent provisions under UAE PDPL and CCPA/CPRA:

Where British Noble relies upon Legitimate Interests under Article 6(1)(f), a written Legitimate Interests Assessment (LIA) balances operational necessity against individual privacy expectations, confirming that zero intrusive tracking occurs.

4. Specific Protections for Authors, Literary Agents & Tax Vaults

Publishing royalty administration involves heightened fiduciary sensitivity because a single literary agency or multi-imprint publishing group may administer bank coordinates and tax residency declarations across thousands of payee entities. Within British Noble, contributor bibliographic fields (intended for public ONIX 3.1.2 distribution) are architecturally segregated from financial payee vaults.

Editorial, design, prepress, and metadata staff seats cannot view or query author bank coordinates, tax identification numbers, or W-8BEN/W-9 documents; access to the Tax & Payout Vault is restricted exclusively to authorised Royalty Finance roles protected by hardware or TOTP multi-factor authentication. Modifications to any payee IBAN, ACH routing number, or agency split percentage trigger mandatory step-up MFA verification, out-of-band email notification to the registered payee, and an immutable entry in the security audit ledger.

5. Zero Sale of Personal Data, Zero Ad-Tech & Zero AI Profiling

British Noble's business model relies solely upon transparent enterprise software licensing and bespoke studio production fees. Accordingly, British Noble makes three absolute privacy commitments across every jurisdiction:

• Zero Sale or Behavioural Sharing: We do not sell personal data for monetary or other valuable consideration, nor do we "share" personal information with third-party advertising networks for cross-context behavioural advertising as defined under the CCPA/CPRA.
• Zero AI Model Training on Personal Data: Personal identifiers, contributor profiles, manuscripts, voice recordings, and correspondence are never supplied to external foundation-model vendors for training, fine-tuning, or dataset enrichment.
• Zero Solely Automated Legal Decisions: British Noble performs no automated profiling or algorithmic scoring producing legal or similarly significant effects on individuals under Article 22 of the GDPR. Manuscript commissioning, peer review, and editorial acceptance remain human-governed decisions.

6. Vetted Infrastructure Sub-Processors & Controlled Disclosures

British Noble discloses personal data solely to strictly vetted categories of recipients required to deliver contracted services or satisfy lawful statutory mandates: (a) sovereign cloud infrastructure providers hosting tenant-isolated compute and KMS storage vaults (Amazon Web Services within Customer's pinned region); (b) regulated financial clearing and payout institutions solely where Customer activates automated royalty disbursements or subscription billing (such as Stripe Connect or Wise Business); (c) enterprise identity providers explicitly federated by Customer (such as Okta, Microsoft Entra ID, or Google Workspace); and (d) retail/library channels solely with respect to public contributor bibliographic metadata explicitly dispatched via ONIX 3.1.2 by Customer.

Every sub-processor executes a binding written Data Processing Agreement enforcing Article 28 GDPR obligations, AES-256 encryption at rest, TLS 1.3 in transit, annual SOC 2 Type II or ISO/IEC 27001:2022 assurance, and strict prohibition against secondary data use. British Noble never discloses personal data to informal requests from third parties; governmental or judicial requests are scrutinised by Legal Counsel for strict jurisdictional validity and proportionality.

7. Sovereign Cloud Pinning & Cross-Border Transfer Safeguards

Publishing organisations select their primary sovereign data-residency zone at workspace provisioning across four regional vaults: United Kingdom (London, eu-west-2), European Union (Frankfurt, eu-central-1), United States (Virginia, us-east-1), and United Arab Emirates (Dubai, me-central-1). Primary relational databases, encrypted manuscript buckets, daily immutable backups, and ephemeral preflight/AI workers remain pinned within that selected region.

Where cross-border transmission of limited personal data is operationally instructed by Customer (for example, dispatching contributor bibliographic metadata to global bookstores across 108 channels, executing multi-currency author royalty wires, or providing follow-the-sun P1 incident support), transfers from the UK, EEA, Switzerland, or UAE are protected by:

• The European Commission Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914;
• The UK Information Commissioner's Office International Data Transfer Addendum (IDTA, Version B1.0);
• Swiss Federal Data Protection and Information Commissioner (FDPIC) cross-border adaptations and UAE PDPL Article 22/23 transfer safeguards; and
• Supplementary technical measures under European Data Protection Board (EDPB) Recommendations 01/2020, including per-tenant KMS envelope encryption and strict minimisation of support diagnostic payloads.

8. Granular Data Retention & Automated Purge Schedules

Personal data is retained strictly for as long as necessary to fulfil the operational or statutory purpose for which it was collected, governed by automated lifecycle policies:

9. Cookie Classification, ePrivacy Consent & Global Privacy Control

In compliance with the UK Privacy and Electronic Communications Regulations (PECR), EU ePrivacy Directive 2002/58/EC, and CCPA/CPRA browser signal rules, British Noble categorises browser storage into three transparent tiers controllable at any time via the Cookie Preferences link in the site footer:

• Tier 1: Strictly Necessary & Security Cookies (Always Active): Essential HTTP-only, Secure, SameSite=Lax/Strict session identifiers, CSRF anti-forgery tokens, SAML 2.0 relay states, and your local cookie-consent preference receipt. Without these tokens, authenticated workspaces cannot operate safely.
• Tier 2: Functional & Currency Memory (Consent-Gated): Stores your chosen pricing display currency (USD, GBP, EUR, or AED) and interactive product-tour step progress across sessions.
• Tier 3: First-Party Product Telemetry (Consent-Gated): Collects aggregated, IP-anonymised page-load performance and Core Web Vitals diagnostics hosted strictly on first-party endpoints. Zero third-party advertising pixels, social-media retargeting beacons, or cross-site fingerprinting scripts are ever loaded on British Noble properties.

When a visitor's browser transmits an active Global Privacy Control (GPC) header (Sec-GPC: 1), British Noble automatically defaults non-essential cookie categories to opted-out state without requiring manual banner interaction.

10. Exercising UK/EU GDPR, CCPA/CPRA & UAE PDPL Rights

Regardless of nationality or domicile, British Noble extends comprehensive statutory data-subject rights across all individuals whose personal data we process as Data Controller:

• Right of Access & Know (GDPR Art. 15 / CCPA Sec. 1798.110 / UAE PDPL Art. 13): Request confirmation of processing and receive an itemised copy of the personal data held about you, processing purposes, retention windows, and recipient categories.
• Right to Rectification (GDPR Art. 16 / CCPA Sec. 1798.106): Correct inaccurate or incomplete contact, contributor, or remittance records.
• Right to Erasure / Deletion (GDPR Art. 17 / CCPA Sec. 1798.105 / UAE PDPL Art. 15): Request deletion of personal data where no overriding statutory tax or contractual retention duty applies.
• Right to Data Portability (GDPR Art. 20 / UAE PDPL Art. 14): Receive structured, machine-readable JSON, CSV, or ONIX XML exports of personal data you provided.
• Right to Restrict, Object & Withdraw Consent (GDPR Arts. 18, 21 & 7(3)): Restrict processing during verification disputes, object to legitimate-interest processing, or withdraw marketing/cookie consent instantaneously without detriment.
• Right to Non-Discrimination: Exercising any privacy right will never result in degraded platform service, retaliatory pricing, or reduced contractual entitlements.

Submit requests via email to Privacy@BritishNoble.com. To protect authors and publishers against unauthorised social-engineering pretexts, we verify requester identity through authenticated workspace confirmation or domain-verified correspondence before releasing records. Substantive responses are delivered free of charge within thirty (30) calendar days (or within 45 days where CCPA statutory complexity extensions apply, with prior notice).

11. Technical Safeguards & Juvenile Literary Protections

British Noble workspaces and websites are institutional business-to-business publishing environments not directed at children under sixteen (16) years of age (or the applicable age of digital consent in the relevant jurisdiction), and we do not knowingly collect personal data directly from minors. Where a publishing house publishes children's literature or contracts with a minor author or illustrator, all contractual, portal, and royalty administration must be executed solely through the minor's adult parent, court-appointed guardian, or accredited literary agent in accordance with publisher governance rules.

All personal data governed by this Notice is protected by TLS 1.3 transport encryption, per-tenant AES-256-GCM storage encryption backed by AWS KMS Hardware Security Modules, role-scoped access controls, and continuous anomaly monitoring as detailed in our Information Security & Cryptography Policy.

12. Data Protection Officer Contact, Regulatory Escalation & Updates

British Noble has appointed a dedicated Data Protection Officer (DPO) overseeing UK, European, North American, and MENA privacy compliance. Direct all privacy enquiries, Data Subject Access Requests, cookie questions, or Transfer Impact Assessment requests to:

Data Protection Officer (DPO) Desk
British Noble (British Noble AI & British Noble Press)
Email: Privacy@BritishNoble.com

If you are unsatisfied with our response, you hold the statutory right to lodge a complaint with your local supervisory authority, including the UK Information Commissioner's Office (ICO) (ico.org.uk), your competent EU/EEA Data Protection Authority (such as BfDI/BayLDA in Germany or CNIL in France), the Swiss FDPIC, the California Privacy Protection Agency (CPPA), or the UAE Data Office. Material updates to this Notice are published on this canonical route with an updated Effective Date and thirty (30) days' advance notification to enterprise workspace administrators.