Privacy notice
Granary Digital Ltd, trading as Between the Lines, decides how the personal data in this notice is used, so we are its controller. This notice says what we collect, why, who helps us and how long we keep it. Students can read a short version: Privacy for students.
Who we are
Granary Digital Ltd, trading as Between the Lines, is registered in England and Wales (company number 14155621). Our registered office is Unit 3 The Old Grainstore, Adsdean Farm, Funtington, Chichester, West Sussex, PO18 9DN. Email hello@btl.education about anything in this notice.
What we collect and why
| What | Why | Lawful basis | How long we keep it |
|---|---|---|---|
| Orders: your name, email address, billing details, what you bought, the licence holder and, for schools, the school’s name and address and the purchase order number | To supply your files, send school licence updates, resend files you lose and keep our accounts | Contract; legal obligation for tax records | Six years after the end of the financial year of the order. The record of who holds each licence is kept for as long as the licence lasts |
| The name and order number printed on your files: a first name and surname initial for a personal licence, the teacher’s name and school, or the school’s name | To show whose copy a file is, so we can trace a copy shared outside its licence | Legitimate interests: protecting our resources | On the files for as long as they exist. We never print an email address |
| Download records: when your download link was used and how many times | To limit each link and resend files when asked | Legitimate interests: running the delivery service | 12 months |
| Email sign-ups: your email address, whether you teach English or are a parent or carer, the free resource you signed up on, and when and to what you agreed | To send the emails you asked for | Consent | Until you unsubscribe. If you click nothing for six months, we ask once whether to keep sending, and remove you if you do not answer |
| Emails to buyers about our other resources | Buyers get these only if they ticked the marketing box at checkout | Consent | Until you unsubscribe |
| Links you click in our emails | To see which emails are useful. We do not track whether you open them | Legitimate interests | Until you unsubscribe |
| Do-not-email list: the address of anyone who unsubscribes or asks us not to contact them | So we never email them again by mistake | Legitimate interests | For as long as we send marketing email |
| Messages and complaints: your name, contact details and what you tell us, by email or on social media | To answer you and fix anything you point out | Legitimate interests | Two years after our last reply, or six years where a complaint or claim may need it |
| Reviews and quotes: your words, and your name, role and school as you agree | To show other teachers and parents what you think | Consent | Until you withdraw permission |
| Website visits: pages viewed, the site you came from, any campaign tag on the link, and your country and type of device, counted as totals | To see which pages and campaigns are useful | Legitimate interests | Totals only. Our analytics tool uses no cookies and stores no IP addresses |
Our website host, Amazon Web Services, receives your IP address so it can send pages to your browser. We do not keep logs of visits.
Card payments are taken through our Shopify checkout, and Shopify tells us that you have paid. We never see your full card number.
To buy, you need to give the details in the first row of the table, because without them we cannot send your files. Everything else is optional.
Emails to heads of English
Two or three times a year, a school-data company sends an email from us to heads of English at state secondary schools. The company holds the contact details and sends the email under its own privacy notice, which the email names. We never receive its list, or any report naming who opened or clicked.
If you reply, order, or ask us not to contact you, we hold your name, school email address and school, as the table above describes. These emails go only to school addresses. We rely on legitimate interests for them, and our assessment is available on request.
Who helps us
We share personal data only with companies that help us run Between the Lines. Each works under a contract that limits what it may do with the data.
- Amazon Web Services hosts the website and stores the files, in its London region, and delivers pages through its worldwide network.
- Shopify runs our shop and checkout and takes card payments.
- Our delivery service adds the licence holder’s name and order number to your files and emails your download link. It runs on Amazon Web Services.
- Our email provider sends the emails people sign up for, along with any service that connects it to our shop.
- Our visit counter is our own and runs on Amazon Web Services. It counts visits without cookies.
- Our accountants keep our books and tax records.
- Our professional advisers and insurers see data only when they need it, and we give data to the police, courts or regulators where the law requires.
Shopify may also use some checkout data for its own purposes, such as preventing fraud, under its own privacy policy. We do not sell personal data, and we do not share it with advertisers.
Transfers outside the UK
Some providers store data, or reach it, from outside the UK, for example in the EU, Canada or the US. When they do, the transfer is covered by UK adequacy regulations or by the international data transfer agreement or addendum issued by the Information Commission. Adequacy regulations cover the EU, Canada, and US companies certified under the UK extension to the EU-US Data Privacy Framework.
Students
Many people who use our site are students, and some are under 18. Students can download our free resources without giving us any details. We do not send marketing emails to students under 16, and we do not use anyone’s data for advertising or profiling.
Keeping data safe
Files and order records are kept in private storage that only we can reach, and download links expire. Every account we use that holds personal data has two-step sign-in.
Your rights
You can ask us to:
- give you a copy of the personal data we hold about you
- correct anything that is wrong
- delete your data, unless the law says we must keep it, as with order records for tax
- limit how we use it, or stop using it for a purpose you object to
- stop sending marketing emails, at any time; every email has an unsubscribe link
- send you the data you gave us in a form you can pass to another organisation
Where we rely on your consent, you can withdraw it at any time. We make no decisions about you by automated means.
Email hello@btl.education. We reply within one month, and there is no charge.
Complaints
If you are unhappy with how we have used your data, tell us first at hello@btl.education. We acknowledge complaints within two working days, look into them, and tell you what we found and what we have done.
You can also complain to the Information Commission, the UK’s data protection regulator, still known as the ICO: ico.org.uk/make-a-complaint, or 0303 123 1113. It usually asks people to complain to the organisation first.
Changes to this notice
We change the date at the top whenever this notice changes. If a change affects how we use data you have already given us, we will email you before it takes effect.