Privacy Notice
Last Updated: July 2026
www.passion-press.com('Website') and our associated progressive web application, Citadel, are provided by PassionPress ('we'/'us'/'our'). In doing so, we may be in a position to receive and process personal information relating to you. As the controller of this information, we're providing this Privacy Notice ('Notice') to explain our approach to personal information. This Notice forms part of our Terms & Conditions, which govern the use of this Website and our digital applications.
We intend only to process personal information fairly and transparently as required by data protection law including the UK General Data Protection Regulation (UK GDPR). In particular, before obtaining information from you (including through use of cookies) we intend to alert you to this Notice, let you know how we intend to process the information (including through use of cookies) and that we'll only process the information as permitted by law. The UK GDPR also defines certain 'special categories' of personal information that's considered more sensitive. These categories require a higher level of protection, as explained below.
Of course, you may browse parts of this Website without providing any information about yourself and without accepting cookies. In that case, it's unlikely we'll possess and process any information relating to you.
We'll start this Notice by setting out the conditions we must satisfy before processing your data. However, you may wish to start with the table at clause 4, which summarises what we intend to collect, or the table at clause 8.5, which summarises our use of cookies. The Notice also explains some of the security measures we take to protect your personal information, and tells you certain things we will or won't do. You should read this Notice in conjunction with the Terms & Conditions.
Sometimes, when you take a new service or product from us, or discuss taking a new service or product but decide against it, we might wish to provide you with further information about similar services or products by email or other written electronic communication. In that situation, we will always give you the opportunity to refuse to receive that further information and if you change your mind please let us know. We'll endeavour to remind you of your right to opt-out on each occasion that we provide such information.
1. Identity and contact details
- Registered number: SC866709
- Registered office: 29/5 Marionville Road, Edinburgh, EH7 5UD
- Email: connect@passion-press.com
2. When we're allowed to collect information from you
We will only collect personal information relating to you if one of the following conditions has been satisfied:
- You have clearly told us that you are content for us to collect that information for the particular purpose or purposes that we will have specified.
- The processing is necessary for the performance of a contract that we have with you.
- The processing is necessary so that we can comply with the law.
- The processing is necessary to protect someone's life.
- The processing is necessary for the performance of a task that's in the public interest.
- The processing is necessary for our or another's legitimate interests - but in this case, we'll balance those interests against your interests.
3. How to consent
3.1 If we need your consent to collect and use certain information, we'll provide you with the opportunity to tell us that you're happy to provide that information at the point of collecting it.
3.2 If at any point in time you change your mind and decide that you want to withdraw your consent, please let us know and we'll endeavour to stop processing your information in the specified manner, or we'll delete your data if there is no continuing reason for possessing it.
3.3 If you don't consent to a particular bit of processing, we'll endeavour to ensure that the Website and our service continue to operate without the need for that information.
4. Information we expect to collect from you
We envisage collecting the following types of information from you:
| Information type | Purpose and related details | Justification |
|---|---|---|
| Identity and Contact Data: Full name, email address, and encrypted account password. | To create and secure your user account, deliver platform updates, send newsletter communications (if opted-in), and respond to your customer support or media inquiries. | It's necessary for the performance of a contract with you. |
| Financial and Transaction Data: Subscription status, billing history, and general location data for currency conversion. (Note: We do not store your raw credit card or bank details. All payment processing is securely handled by our third-party provider, Stripe). | To process your monthly subscription securely, manage billing cycles, and most importantly, ensure the funds are accurately routed to the specific indie authors you spend your time reading. | It's necessary for the performance of a contract with you. |
| Platform Usage and Profile Data: Reading history, and saved platform preferences (such as custom reading themes or display settings). | To deliver your tailored reading experience, and maintain your progress across your devices. (We've removed any information that might identify you in such a way that it should not be possible to reassemble the data). | It's necessary for the performance of a contract with you. |
| Technical and Analytics Data: IP address, device type, browser type, and interactions with our platform (such as page views and navigation paths). | To ensure the website functions securely and renders correctly on your specific device. To avoid fraudulent use of the account by multiple people. If you explicitly consent via our cookie banner, we also use Google Analytics to analyse aggregated traffic patterns so we can continuously improve the platform's design and features. | It's necessary for the performance of a contract with you. |
4.1 We may collect personal information about you from a number of sources, including the following:
- From you when you agree to take a service or product from us.
- From you when you contact us with an enquiry or in response to a communication from us.
- Automatically as you interact with our platform by using cookies and other similar technologies.
- From documents that are available to the public, such as the electoral register.
- From third parties to whom you have provided information with your consent to pass it on.
4.2 If you refuse to provide information requested, then if that information is necessary for a service we provide to you we may need to stop providing that service.
5. Using your personal information
Data protection, privacy and security are important to us, and we shall only use your personal information for specified purposes and shall not keep such personal information longer than is necessary to fulfil these purposes.
- To help us to identify you when you contact us.
- To help us to identify accounts, services and/or products which you could have from us or selected partners from time to time.
- To help us to administer and to contact you about improved administration of our services.
- To allow us to carry out marketing analysis, customer profiling, and conduct research.
- To help to prevent and detect fraud or loss.
- To allow us to contact you by written electronic means about products and services similar to those you have already purchased, provided you have not opted out.
We may monitor and record communications with you (including phone conversations and emails) for quality assurance and compliance. When required by law, we'll check your details with fraud prevention agencies.
6. Sharing your information
We will not disclose your personal information to any third party except in accordance with this Notice, and then only in one of the following circumstances:
- They are processing the data on our behalf as a contracted data processor.
- It is necessary to share data with another data controller, or if PassionPress is acquired by a third party.
- If we have been legitimately asked to provide information for legal or regulatory purposes or as part of legal proceedings.
We may employ companies and individuals to perform functions on our behalf (e.g., tracking packages, sending email, data analysis). From time to time, these partners may be outside the European Economic Area. We will take all steps reasonably necessary to ensure that your personal information is treated securely and in accordance with the UK GDPR.
7. Protecting information, Data Security, and Encryption
7.1 General Security Standards: We maintain physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of personally identifiable customer information. Our security procedures mean that we may occasionally request proof of identity before we disclose personal information to you.
7.2 Data Security and Encryption: We are committed to ensuring your personal information is secure. To protect your data during transmission, we use Secure Sockets Layer (SSL) and Transport Layer Security (TLS) encryption software. This ensures that any data exchanged between your browser, the Citadel app, and our servers — including login credentials and personal preferences — is strictly encrypted.
7.3 Payment Security: We do not store or process your sensitive financial information directly. All subscription payments are handled securely through our authorised third-party payment processor, Stripe. Stripe operates under stringent, bank-level security standards (PCI-DSS compliant) and uses advanced SSL/TLS encryption to ensure your payment details are kept safe and confidential.
7.4 User Responsibility: It is important for you to protect against unauthorised access to your password and to your computer. Be sure to sign off when you finish using a shared device. Remember that standard unencrypted emails sent over the internet are not completely secure.
8. Cookies and other internet tracking technology
When we provide services, we want to make them easy, useful and reliable. This involves placing small amounts of information on your device called 'cookies'.
8.5 Cookie Usage Table
| Cookie name | Cookie qualities | Consent needed | Category |
|---|---|---|---|
| _ga (and associated _ga_[ID] cookies) | To assign a randomly generated number to recognise unique visitors, allowing us to track website traffic, understand how users navigate the platform, and identify which pages are most popular. (Category 2 - Performance) | Yes | 1 - Strictly Necessary: Essential in order to enable you to move around the platform and use its features. They do not require your consent, though we must still tell you about them. |
| citadel_cookie_consent | To remember whether the user has accepted or rejected non-essential tracking cookies, ensuring they are not repeatedly shown the consent banner. (Category 1 - Essential) | No | 2 - Performance: These cookies collect information about how visitors use a platform to help us improve how it works. These require your specific and informed consent. |
9. Your legal rights
Under the UK GDPR, you have the right to:
- Request access to your personal information.
- Request correction of any incomplete or inaccurate information we hold about you.
- Request erasure of your personal information when there is no good reason for us continuing to process it.
- Object to processing where we are relying on a legitimate interest or using your data for direct marketing.
- Request restriction of processing to suspend the processing of your data in specific scenarios.
- Request the transfer of your data to you or a third party in a structured, machine-readable format.
- Withdraw consent at any time where we are relying on consent to process your information.
We try to respond to all legitimate requests within one month. We do not charge a fee to exercise your rights unless your request is clearly unfounded, repetitive, or excessive.
10. Further information
If you would like any more information, have comments about this Notice, or wish to exercise any of your legal rights, please email us at connect@passion-press.com.