Privacy policy

Who we are

Special North ("we", "us", "our") is an international children's book publisher and producer. We operate from Kuala Lumpur, Malaysia, and work across Malaysia and Singapore.

We are responsible for the personal information collected through specialnorth.com. We are the data controller, in the language of European law, and the data user under Malaysia's Personal Data Protection Act 2010.

You can reach us at aida.ismail@specialnorth.com, or through the contact page at /contact.

What this policy covers

This policy covers specialnorth.com: the pages you read, the forms you submit, the newsletter you can subscribe to, and the shop preview.

It does not cover other companies' sites. When you follow a link to a bookseller, a social platform, a partner or a press outlet, you are on their site under their policy, and we have no control over what they collect.

What the site stores on your own device is set out in the cookie policy at /cookies, which forms part of this policy.

The information you give us

We only receive what you type into a form and send. Nothing on this site asks you to create an account, and nothing anywhere on it asks for payment details.

Depending on which form you use, that is:

• General enquiry: your name, email address and message.
• Airline, MRO or corporate enquiry: your name, organisation, role, work email, country or region, and message.
• School or museum enquiry: your name, the school or museum, your email, country or region, and message.
• Press enquiry: your name, outlet, email address, and what you need.
• Partnership proposal: your name, organisation, role, work email, country or region, the area of partnership you are interested in, and anything you tell us about your fleet, region or programme.
• Newsletter: your email address, and nothing else.

We have no use for special categories of information (health, religion, political opinions, ethnicity, identity or passport numbers, financial details), and we ask you not to put them in a message box. If you send them anyway, we delete them from our records once the enquiry is answered.

The information collected automatically

Some information reaches us simply because a browser asked a server for a page. It is short, and most of it is discarded quickly.

• Request data: your IP address, browser and device type, the page requested and the time of the request, recorded in the web server's log by our hosting provider, as on any website.
• An anti-spam counter: when you submit a form, your IP address is used to count submissions per minute so that one script cannot flood us. The counter lives in the server's memory, is discarded within the minute, and is never written to a database.
• Analytics, and only if you accept cookies: pages viewed, approximate location derived from a truncated IP address, device, browser, and how you arrived. It is not linked to your name or your email address.

We do not buy data about you from anyone. We run no advertising or retargeting trackers. We build no profiles and make no automated decisions about you. We do not use your enquiry, your message or your email address to train artificial intelligence models, ours or anyone else's.

Why we use it, and on what basis

Every use has a purpose and a lawful basis behind it. There is nothing here beyond running a publisher's website.

• To reply to your enquiry and continue the conversation: because you asked us to, and because answering its post is a legitimate interest of any business.
• To prepare proposals, quotations and partnership material for organisations that request them: steps taken at your request before entering a contract.
• To send the newsletter: your consent, given when you subscribe and withdrawn whenever you like.
• To keep the site available and to stop spam, abuse and automated attacks: our legitimate interest in a working site, weighed against the very small amount of data involved.
• To measure how the site is used so we can improve it: your consent, given through the cookie banner and withdrawn through the cookie preferences link in the footer.
• To meet legal, accounting and tax obligations where a partnership becomes a contract: compliance with the law.

Where the Personal Data Protection Act 2010 applies, we process your information with your consent and where it is necessary for the transaction you have asked us about. Where the GDPR or UK GDPR applies to you, the bases above are the ones we rely on.

Who else sees it

The list is deliberately short, and we would rather keep it that way.

• The Special North team members who handle that kind of enquiry.
• Our hosting provider, which runs the server the site and its logs sit on.
• Our email provider, which carries each submission from the site to our inbox and stores it there.
• Google, if and only if you accepted analytics cookies. Google processes that data on our behalf; see the cookie policy.
• Professional advisers, or an authority, where the law requires it of us.

We do not sell, rent or trade your details, and we never will. If we add a dedicated email or customer-relationship service to deliver messages, this page will name it before we start using it.

Where your information is processed

We work from Malaysia, but the providers above operate internationally, so your information may be processed on servers outside your own country, including in the European Economic Area and the United States.

Where the GDPR or UK GDPR applies to you, we rely on the safeguards those providers have in place for such transfers, such as an adequacy decision or the European Commission's standard contractual clauses. Where the PDPA applies, we take reasonable steps to ensure a comparable standard of protection. Keeping the number of providers small is part of how we do that.

How long we keep it

We keep things for as long as the reason we collected them lasts, and then we stop.

• Enquiries: for as long as the conversation is live, and for two years afterwards so that we recognise you if you come back. Then they are deleted.
• Partnership proposals and agreements: for the life of the discussion, and for up to six years after any resulting agreement ends, where accounting and tax law requires the record.
• Newsletter: until you unsubscribe. Every email we send carries an unsubscribe link at the bottom, and it takes one click.
• Server logs: the short rotation set by our hosting provider, measured in weeks rather than years.
• The anti-spam counter: under a minute, in memory only.
• Analytics: the cookies expire up to two years after your last visit, and the underlying event data is deleted by Google on the retention period set in our property.

You can ask us to delete any of it sooner. See your rights, below.

How we protect it

Specific measures, rather than a promise of perfection:

• The whole site is served over HTTPS, so what you type is encrypted in transit.
• Form submissions are validated and size-limited on the server, rate-limited per address, and screened for automated posting before anything is delivered.
• Submissions reach a small number of named mailboxes, not an inbox the whole company can read.
• We take no card or bank details anywhere on this site, because nothing on it is for sale yet.

No website or email system is perfectly secure, and anyone who says otherwise is selling something. If a breach ever affects your personal information and is likely to put you at risk, we will tell you and the relevant authority without delay.

Your rights

Wherever you are, you can ask us for the following, and we will not charge you for asking.

• Access: a copy of the personal information we hold about you, and an explanation of what we do with it.
• Correction: have anything inaccurate or incomplete put right.
• Deletion: have it erased, where we have no continuing reason or legal obligation to keep it.
• Withdrawal of consent: unsubscribe from the newsletter, or change your cookie choice from the footer of any page, at any time. Withdrawing consent does not undo what was done while it was in force.
• Objection and restriction: object to processing we base on legitimate interests, or ask us to pause it while a disagreement is resolved.
• Portability: receive what you gave us in a common, machine-readable format.

To exercise any of these, write to aida.ismail@specialnorth.com or use the contact page at /contact. We may ask for something that confirms the request really comes from you, usually replying from the address we already hold. We respond within 30 days, and if a request is unusually complex we will tell you why before that deadline passes.

Children

Our books are for children. Our website is for the adults who buy them, teach with them and partner on them.

We do not knowingly collect personal information from anyone under 16, there is no account for a child to create, and nothing on the site profiles children or aims advertising at them. If you believe a child has sent us their details, tell us and we will delete them.

Changes to this policy

When this policy changes, the date at the top of this page changes with it. If a change materially affects how we use information you have already given us, we will say so on the site and tell subscribers by email where it is appropriate to do so.

Continuing to use the site after a change means you accept the updated policy.

Contact and complaints

Any question about this policy, or about your information, goes to aida.ismail@specialnorth.com or through /contact. A person reads it.

If you think we have handled your information badly, please give us the chance to put it right first. You also have the right to complain to a regulator: in Malaysia, the Personal Data Protection Department (JPDP) under the Personal Data Protection Act 2010; in the European Economic Area, your national supervisory authority; in the United Kingdom, the Information Commissioner's Office.