Privacy Policy | Institutional Suite

1. Who we are

This website is run by Institutional Suite, which is responsible for your personal information (the “controller”, in the language of UK data protection law). You can reach us at support@institutionalsuite.com.

2. Information We Collect

a) Information you give us

When you buy a book, write to us, or use the contact form, you may provide:

Your name and email address
Payment details, which go straight to the payment provider and never to us
Anything you choose to include in a message to us

You do not need an account to read this website.

b) The contact form

If you write to us through the contact form, the name, email address, topic and message you type are sent to our support inbox by email. They are kept there so we can answer you and refer back to the conversation if you write again. They are not added to any mailing list and are not used for marketing.

c) Information collected automatically

Like every website, ours is run on a web server that records each request it receives, including your IP address and browser type, in its logs. Our hosting provider keeps these for a short time to keep the Service working and secure, for example to block attacks.

We also count visits anonymously, as explained in section 5.

3. Payment Processing

All payments are handled by Payhip, and the card processors it works with. When you press a Buy button you go to a checkout run by Payhip on its own website.

We never see, store or process your card details. Payhip tells us what you bought and the name and email address you gave at checkout, so we can deliver your order and help you with it. Payhip processes your information under its own privacy policy.

4. How We Use Your Information, and Why We May

UK data protection law asks us to say which legal reason, or “lawful basis”, we rely on for each use:

To deliver what you bought, and to process payments and any refunds: because it is needed for our contract with you.
To answer your messages and help with your order: our legitimate interest in looking after our customers.
To keep the Service secure and prevent misuse: our legitimate interest in running a safe website.
To count visits anonymously and improve the website (section 5): our legitimate interest in understanding what helps our readers.
To keep business and tax records: because the law requires it.

We do not sell, rent or trade your personal data, and we do not make automated decisions about you.

5. How We Count Visits

To see which pages help readers and which do not, this website counts its own visits. The counter runs on this website, not on Google or any other company, and it sets no cookies.

When you open a page, the counter notes which page it is, the name of the website that sent you there (for example “google.com”, never the page you were on), any campaign tags on the link, whether you are on a phone, tablet or computer, your browser’s language, how long the page was on screen, and which buttons you pressed. To tell visitors apart within a single day, it makes a code from your IP address and browser details, scrambled with a secret that changes every day and is deleted when the day ends. Your IP address itself is never stored, and the code cannot be turned back into it or used to follow you from one day to the next.

At the end of each day these notes are added up into totals, such as “120 visitors, 40 from Instagram”, and the notes and that day’s secret are deleted. Only the totals are kept, for up to two years. They cannot identify anyone and are never shared.

UK law (the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025) allows a website to count visits in this limited way without asking first, provided it explains it clearly and lets you switch it off simply and for free. To switch it off, choose Reject all in the cookie banner, or turn off Anonymous visit counting in Cookie settings. If your browser sends a Global Privacy Control signal, counting is off unless you turn it on.

6. Cookies, Analytics and Advertising

We do not use Google Analytics, advertising cookies, tracking pixels or any other company’s analytics on this website. If that ever changes, this policy will be updated first, and the cookie banner will ask for your consent before anything is switched on.

Everything stored on your device, and for how long, is listed in our Cookie Policy.

7. Who We Share It With

We share personal information only where it is needed to run the Service:

Payhip, which runs our checkout and delivers your download
Our hosting provider, which runs the website and our email
Professional advisers, or the authorities where the law requires it

Each of them must protect your information and use it only as data protection law allows.

8. Information Sent Outside the UK

Some of the companies above may store or handle information outside the United Kingdom. When that happens, it is protected by the safeguards UK law requires, such as UK “adequacy” regulations or the data transfer agreements approved by the Information Commissioner.

9. How Long We Keep It

Orders: for six years, because UK tax law requires business records to be kept that long.
Messages to us: for up to two years after we last hear from you, unless they relate to an order.
Anonymous visit counts: the daily notes are deleted at the end of each day; the totals, which identify nobody, are kept for up to two years.
Server logs: kept by our hosting provider for a short period for security, then deleted.

When information is no longer needed, it is securely deleted or made anonymous.

10. Your Rights

Under UK data protection law you have the right to:

See the personal information we hold about you
Ask us to correct anything inaccurate
Ask us to delete your information
Object to, or ask us to restrict, how we use it, including the anonymous visit counting
Receive a copy of information you gave us, in a common format
Withdraw your consent at any time, for anything that relies on it, through Cookie settings

To use any of these rights, write to us at the address in section 15. We will reply within one month.

If you are not happy with our response, you can complain to the Information Commissioner’s Office at ico.org.uk.

11. Data Security

We take reasonable technical and organisational measures to protect your information against unauthorised access, loss, misuse and disclosure. The website is only ever served over an encrypted connection.

No method of sending information over the internet is completely secure, but the Service is designed to hold as little as possible, and therefore to put as little as possible at risk.

12. Children’s Privacy

This Service is not intended for anyone under the age of 18. We do not knowingly collect personal information from children.

13. Links to Other Websites

Links to other websites, including Payhip’s checkout, take you to services we do not control. Their own privacy policies apply there.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top always shows when it last changed. If a change affects how we use information you have already given us, we will tell you before it applies.

15. Contact

If you have questions about this Privacy Policy, or about how your information is handled, write to us at:

support@institutionalsuite.com