Publishing Privacy Policy
EBOKIO Effective Date: 12 July 2026 Last Updated: 12 July 2026 Version: 1.0
Company: EBOKIO LTD, a private limited company registered in England and Wales
Applies to: publishing.ebokio.com and the related seller dashboards, author tools, publisher accounts, upload interfaces, distribution systems, and self-publishing services operated by EBOKIO LTD.
1. Introduction
This Self-Publishing Privacy Policy (the "Policy") explains how EBOKIO LTD ("EBOKIO", "we", "us", or "our") collects, uses, stores, discloses, transfers, retains, and otherwise processes personal data relating to authors, publishers, rights holders, literary agents, distributors, account administrators, and other persons or entities who upload, submit, manage, distribute, market, or sell ebooks or related digital content through EBOKIO's self-publishing services (together, "Publishers").
EBOKIO LTD is a private limited company registered in England and Wales under company number 17308940, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom.
For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (as amended), and other applicable data protection laws, EBOKIO LTD acts as the data controller of personal data processed under this Policy, except where this Policy expressly states otherwise or where another person or entity acts as an independent controller or joint controller under applicable law.
This Policy forms part of EBOKIO's wider legal framework and should be read together with the EBOKIO Terms of Service, Privacy Policy, Cookie Policy, Content Policy, Copyright Notice and Takedown Policy, Refund and Returns Policy, and any additional notices, product disclosures, or compliance statements made available through the Platform from time to time.
2. Scope of This Policy
This Policy applies to personal data processed in connection with the onboarding, verification, registration, management, moderation, operation, monetisation, support, enforcement, and closure of self-publishing and seller accounts on EBOKIO.
Without limitation, this Policy applies where a Publisher:
creates or administers a seller, author, or publisher account;
uploads manuscripts, EPUB files, DOCX files, covers, metadata, descriptions, sample chapters, or related submission materials;
configures pricing, territories, distribution settings, payout details, tax information, author profiles, or publication preferences;
receives royalties, earnings statements, payouts, refunds, reversals, or chargeback-related notices;
submits or responds to rights complaints, takedown notices, moderation actions, appeals, or verification requests; or
otherwise uses EBOKIO's self-publishing dashboard, author tools, listing interfaces, content review systems, or related business services.
This Policy does not govern personal data processed solely in connection with general browsing of third-party websites, third-party payment environments, third-party single sign-on providers, or other independent third-party services whose privacy practices are governed by their own notices and policies.
Where a Publisher also uses the EBOKIO reader storefront at www.ebokio.com as a customer — for example to browse, purchase, or read ebooks — the personal data processed in that capacity is described in the separate EBOKIO Privacy Policy. This Policy governs personal data processed in connection with publishing and selling on publishing.ebokio.com.
3. Contact Details
Questions, complaints, requests, or notices relating to this Policy or personal data processed under it should be directed to:
EBOKIO LTD
Privacy and Data Protection: privacy@ebokio.com
Legal Notices and Rights Complaints: legal@ebokio.com
General Support: support@ebokio.com
Registered Office Address: 128 City Road, London, EC1V 2NX, United Kingdom
Website: https://publishing.ebokio.com
EBOKIO LTD is established in the United Kingdom and has not appointed a Data Protection Officer, because its processing does not meet the conditions that make such an appointment mandatory under Article 37 of the UK GDPR or of the EU GDPR. Separately, where the EU GDPR requires EBOKIO to designate a representative in the European Union under its Article 27, that representative's name and contact details will be published in this Policy and on the publishing portal. Until then, Publishers may contact EBOKIO directly at privacy@ebokio.com about any data protection matter, and may also complain to their own local supervisory authority.
4. Categories of Personal Data We Process
Depending on the nature of the Publisher relationship and the services used, EBOKIO may collect and process the following categories of personal data.
4.1 Identity and Account Data
This may include:
full legal name;
display name;
pen name;
business or trading name;
email address;
telephone number;
country of residence or incorporation;
date of birth where reasonably required for age verification, security, or compliance;
account credentials, authentication data, and account identifiers;
user role, account status, profile information, and account preferences.
4.2 Publisher, Business, and Tax Data
This may include:
company registration details;
VAT number or tax identification number;
taxpayer status and tax residency information;
invoicing and business contact details;
certifications, declarations, or forms required for tax, sanctions, compliance, or marketplace administration;
documents or information reasonably required to verify authority to act on behalf of a business or publishing entity.
4.3 Payout and Financial Data
This may include:
payout account name;
bank name;
sort code;
account number;
IBAN;
SWIFT/BIC;
payment processor account identifiers;
partial billing information;
transaction records;
royalty calculations;
earnings statements;
payout history;
refunds, reversals, deductions, set-offs, chargebacks, and related financial dispute records.
EBOKIO does not store full payment card numbers (PAN) or card security codes (CVV/CVC). Card data is collected and held by Stripe, Inc. as EBOKIO's payment service provider. Where a Publisher saves a card for subscription payments, EBOKIO stores only limited non-sensitive details — the card brand, the last four digits, and the expiry month and year — together with a payment-method reference issued by Stripe.
4.4 Content Submission and Listing Data
This may include:
manuscripts and uploaded ebook files;
cover images, thumbnails, illustrations, and related assets;
preview files, sample chapters, and promotional excerpts;
book titles, subtitles, descriptions, categories, keywords, ISBN data, publication dates, language selections, series information, and listing metadata;
technical file details such as file format, file size, timestamps, conversion status, version history, and device compatibility data;
pricing, territorial rights, distribution preferences, and publication settings.
4.5 Rights, Compliance, and Evidence Data
This may include:
copyright ownership information;
licence or assignment records;
permissions and rights-clearance materials;
authorship evidence;
AI-use disclosures and related supporting materials;
moderation history;
enforcement records;
notices and counter-notices;
correspondence with rights holders, complainants, regulators, service providers, or advisers;
materials preserved for legal claims, fraud prevention, rights enforcement, safety, or audit purposes.
4.6 Technical, Usage, and Security Data
This may include:
IP address;
browser type and version;
operating system and device information;
user agent string;
login history;
session data;
access timestamps;
approximate geolocation derived from IP address;
referral data;
platform usage logs;
upload logs;
failed authentication attempts;
device and risk signals;
suspected abuse indicators;
VPN or proxy indicators;
fraud and security event records.
4.7 Communications and Support Data
This may include:
emails;
support tickets;
moderation communications;
compliance requests;
appeal submissions;
legal correspondence;
complaint records;
communications preferences;
records of notices sent to or received from the Publisher.
4.8 Public Profile and Marketplace Data
This may include information intentionally made public by the Publisher through the Platform, such as:
author name or pen name;
publisher name;
author biography;
profile image;
public-facing catalogue and listing information;
other profile or brand information the Publisher chooses to display to buyers or visitors.
4.9 Special Category Data
EBOKIO does not ask Publishers for special category data (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or data concerning health, sex life, or sexual orientation) and does not seek to collect it. Identity documents are reviewed only to confirm identity, authority, and eligibility; they are not used to derive any special category of data, no biometric identification is carried out, and the documents are deleted immediately once the check is completed (see section 7).
Where a Publisher volunteers such data — for example in a support message, a complaint, or an accessibility request — EBOKIO processes it on the basis of the Publisher's explicit consent under Article 9(2)(a), and only to handle the matter raised; and on Article 9(2)(f) where the data is necessary to establish, exercise, or defend a legal claim. Manuscripts and other uploaded content may themselves contain special category data relating to third parties; the Publisher is responsible for having a lawful basis for that content, as set out in section 14.
5. How We Collect Personal Data
We collect personal data in the following ways.
5.1 Data Provided Directly by Publishers
We collect data provided directly when a Publisher:
registers or updates an account;
completes onboarding or verification processes;
uploads content or listing materials;
enters payout, tax, or business information;
submits support requests or legal responses;
communicates with EBOKIO;
appeals moderation or enforcement decisions;
participates in surveys, beta features, or service improvement initiatives.
5.2 Data Collected Automatically
We collect certain technical and behavioural data automatically through server logs, cookies, local storage, fraud-detection tools, security monitoring systems, and technical processing activities used to operate, secure, and improve the Platform. EBOKIO also uses Vercel Web Analytics on publishing.ebokio.com to measure aggregate traffic, page views, and referral sources. Vercel Web Analytics is cookieless: it does not set cookies and does not store or read information on your device, it does not track you across other websites or applications, and a visit is identified only by a hash derived from the incoming request, which is discarded after 24 hours. EBOKIO does not use advertising, retargeting, or cross-site tracking tools.
Details concerning cookies and similar technologies are set out separately in the EBOKIO Cookie Policy.
5.3 Data Received from Third Parties
We may receive relevant personal data from third parties, including:
payment processors and payout providers (currently Stripe, Inc.), banks, and financial institutions;
hosting, infrastructure, and content-delivery providers (currently Hostinger International Ltd. for back-end systems and Hetzner Online GmbH for cloud and AI infrastructure, both with servers located in the European Union, and Vercel Inc. for delivery of the front-end interface, which is established in the United States);
single sign-on providers where enabled (currently Google, and only where a Publisher chooses to sign in with Google);
rights holders, complainants, publishers, buyers, and other users involved in disputes or notices;
legal, regulatory, tax, or law enforcement authorities;
professional advisers, auditors, insurers, and compliance providers.
6. Purposes of Processing and Legal Bases
EBOKIO processes personal data only where there is a lawful basis to do so under applicable law.
6.1 Performance of a Contract
We process personal data where necessary to enter into or perform a contract with the Publisher, including to:
create, administer, and maintain publisher accounts;
provide access to self-publishing tools and dashboard features;
host, process, convert, index, distribute, and make available digital content;
administer listings, pricing, territories, and catalogue settings;
calculate royalties, administer earnings, and process payouts;
provide support and account communications;
administer refunds, disputes, and chargeback-related matters;
manage account closure and post-termination obligations.
6.2 Compliance with Legal Obligations
We process personal data where necessary to comply with legal and regulatory obligations, including obligations relating to:
accounting and financial record-keeping;
taxation, VAT, and reporting obligations;
sanctions, anti-fraud, and compliance screening;
consumer protection and e-commerce obligations;
copyright and rights-enforcement issues;
lawful requests, court orders, regulatory enquiries, and law enforcement requests;
evidence preservation and legal hold requirements;
record retention obligations imposed by law.
6.3 Legitimate Interests
We may process personal data where such processing is necessary for EBOKIO's legitimate interests or those of a third party, provided those interests are not overridden by the Publisher's rights and freedoms. These interests include:
operating, securing, monitoring, and improving the Platform;
detecting, investigating, and preventing fraud, abuse, piracy, security incidents, unauthorised access, policy evasion, and commercially abusive behaviour;
verifying authenticity, authorship, and rights ownership;
enforcing the Terms of Service, Content Policy, Copyright Notice and Takedown Policy, and other platform rules;
preserving evidence and maintaining internal records;
defending or pursuing legal claims;
responding to complaints, notices, and disputes;
protecting buyers, publishers, service providers, and the public;
conducting business and website analytics (including the cookieless measurement described in section 5.2), service development, and operational planning.
6.4 Consent
Where required by law, we rely on the Publisher's consent for specific processing activities, such as non-essential cookies, certain marketing communications, or optional product features. Consent (Article 6(1)(a) UK GDPR) is also the basis on which EBOKIO operates the Meta Pixel on publishing.ebokio.com, as described in section 10; the Pixel does not load unless you accept the Marketing category, and you may withdraw that consent at any time through the cookie banner. EBOKIO's website analytics are cookieless and neither store nor access information on your device, so they do not require cookie consent under the Privacy and Electronic Communications Regulations 2003; they are carried out on the basis of EBOKIO's legitimate interests in understanding and improving the Platform (see section 6.3), and the Publisher may object to that processing at any time. If EBOKIO introduces cookie-based analytics or any advertising tool in future, this Policy will be updated first and such tools will be activated only after valid consent has been obtained where consent is required. Consent may be withdrawn at any time, but withdrawal does not affect the lawfulness of processing carried out before withdrawal.
7. Verification, Screening, and Fraud Prevention
Where EBOKIO has reasonable grounds to doubt a Publisher's identity, or to address fraud, sanctions, money-laundering, or other legal-compliance risk, EBOKIO may process personal data to verify the Publisher's identity, authority, tax status, payout eligibility, sanctions status, and overall account legitimacy.
This may include reviewing account details, technical signals, device and access patterns, file submission behaviour, financial risk indicators, prior complaints, rights documentation, authorship evidence, and other information reasonably necessary to prevent fraud, piracy, abuse, duplication, payment risk, rights infringement, regulatory exposure, or misuse of the Platform.
EBOKIO also estimates a Publisher's approximate location (country or region) from their IP address using the MaxMind GeoLite2 database, which is hosted locally on EBOKIO's own systems so that the IP address is not sent to MaxMind. This is used to detect and prevent fraud and abuse and to protect account security, on the basis of EBOKIO's legitimate interests, and is not used for behavioural advertising or tracking.
Where reasonably necessary and proportionate, EBOKIO may request additional information or documents, delay publication, delay payout, impose account restrictions, preserve records, or suspend features pending completion of a verification, safety, or compliance review. Where EBOKIO collects identity documents or verification images (such as a copy of a passport or identity card) to verify a Publisher, EBOKIO deletes those documents and images immediately once the verification check is completed, and keeps only a minimal record confirming that verification took place (for example, the date, method, and result), not the document images themselves. EBOKIO does not retain identity document images for longer than is necessary for the verification. These checks are carried out by EBOKIO's own staff on its own systems; EBOKIO does not outsource identity verification, sanctions screening, or KYC/AML checks to an external provider, and does not share identity documents with one.
Automated tools and human review. EBOKIO uses automated and semi-automated tools to help screen accounts, submissions, and transactions — for example fraud and risk scoring, duplicate-content detection, malware scanning, and automated content classification. These tools support human decision-making; EBOKIO does not take a decision based solely on automated processing that produces legal effects for a Publisher or similarly significantly affects them — such as suspending or terminating a Publisher Account, withholding or delaying a payout, or removing a Work — without human review. Where such a decision is taken, the Publisher may express their point of view, request human intervention, obtain an explanation, and contest the decision by contacting privacy@ebokio.com or using the appeal routes described in the EBOKIO Content Policy and Copyright Notice and Takedown Policy.
8. File Processing, Content Review, and Platform Operations
Where a Publisher uploads files or related materials, EBOKIO may process those files and associated data to:
store and host them securely;
scan them for malware or harmful code;
extract and process metadata;
generate previews, samples, and thumbnails;
create backup copies;
convert files into supported formats;
optimise compatibility and delivery;
apply DRM, watermarking, or comparable protection measures;
index content for search, discovery, and internal administration;
review content for quality, legality, authenticity, and compliance with platform rules;
investigate complaints, rights notices, and moderation issues;
facilitate distribution, access, support, and customer service.
Nothing in this Policy obliges EBOKIO to publish, continue to publish, or distribute any content, and content-related decisions remain subject to the Terms of Service, Content Policy, and other applicable EBOKIO policies.
AI Tools and third-party AI processing. Where a Publisher uses the AI Tools (such as the AI Cover generator, AI Metadata Autofill, the Writing Studio and Muse, and the AI Author Co-pilot), the content submitted to those tools — which may include manuscript text, metadata, story-bible content, and prompts — is processed by a third-party AI service provider acting as EBOKIO's processor. That provider is bound by a written data processing agreement, may process the content only on EBOKIO's documented instructions, and is not permitted to use it to train its own models or for any purpose of its own. Where that provider is located outside the United Kingdom or the EEA, the transfer is protected by the safeguards described in section 11 of this Policy. Publishers retain all rights in their Works; this processing does not transfer any ownership.
9. Public and Non-Public Information
Certain information submitted by a Publisher may be displayed publicly through the Platform, including author name, pen name, publisher name, biography, listing details, cover images, descriptions, catalogue metadata, and other information intentionally made public through the listing or profile settings.
Publishers are solely responsible for ensuring that public-facing materials do not include unnecessary personal data, confidential information, or data they are not entitled to disclose.
Non-public information, such as legal identity records, tax documents, bank details, internal risk assessments, private moderation notes, account verification materials, internal enforcement records, and preserved evidence, will not be made public by EBOKIO except where disclosure is required or permitted by law, reasonably necessary for the protection of rights, or necessary in connection with a dispute, investigation, regulatory obligation, or contractual enforcement.
10. Data Sharing and Disclosure
EBOKIO does not sell or rent Publisher personal data to third parties for unrelated commercial marketing purposes.
We may share personal data where reasonably necessary with:
payment processors and payout providers (currently Stripe, Inc.), banks, and financial institutions;
third-party AI service providers that power the AI Tools, acting as EBOKIO's processors and prohibited from using Publisher content to train their own models;
hosting, infrastructure, cloud storage, and email or communications providers (currently Hostinger for back-end systems and Hetzner for cloud and AI infrastructure, both with servers located in the European Union, and Vercel Inc. for delivery of the front-end interface, which is established in the United States);
security, fraud prevention, and compliance vendors;
Vercel Inc. also provides cookieless website analytics for publishing.ebokio.com (aggregate traffic and page-view measurement). Meta Platforms Ireland Limited receives data through the Meta Pixel on publishing.ebokio.com, but only where a visitor accepts the Marketing category in the cookie banner. The Pixel sends two events — a page view and a record that an author registration was completed. When the Pixel is active, Meta may receive that event information, the relevant public page address and referrer, cookie identifiers, and standard technical browser and device information generated by the connection, including your IP address. EBOKIO does not pass book titles, product identifiers, or other custom parameters to Meta, and Meta's automatic form-field matching and codeless event collection are disabled, so EBOKIO does not pass your email address, telephone number, or name. It never runs on dashboards, account pages, or pages carrying a verification or password-reset token. In respect of the collection and transmission of that data, EBOKIO and Meta act as joint controllers within the meaning of Article 26 UK GDPR, under the controller arrangement Meta makes available in its business tools terms; Meta's subsequent use of the data for its own purposes is governed by Meta's own privacy policy. You can withdraw your consent at any time through the cookie banner, after which the Pixel stops running. EBOKIO engages no other advertising, retargeting, or marketing-profiling providers; if it does so in future, this Policy will be updated and, where required, consent will be obtained before any such tracking begins;
Identity verification, sanctions screening, and KYC/AML checks are carried out by EBOKIO's own staff, and are not outsourced to an external provider;
professional advisers, auditors, insurers, and tax advisers;
rights holders, complainants, buyers, publishers, users, or counterparties involved in a dispute, notice, complaint, or enforcement matter where disclosure is reasonably necessary and lawful;
regulators, courts, law enforcement bodies, and competent authorities;
acquirers, investors, administrators, or counterparties in connection with a merger, acquisition, restructuring, insolvency process, financing, or sale of business assets, subject to applicable safeguards.
Where a transaction requires limited information to be shared between marketplace participants, EBOKIO may disclose only the information reasonably necessary to administer the transaction, support, refund, dispute, chargeback, fraud review, or legal compliance process.
Publishers who receive buyer data through or from EBOKIO must process that data lawfully and only for purposes authorised by applicable law and the EBOKIO contractual framework. Buyer data must not be used for unrelated marketing, scraping, profiling, resale, or off-platform communications without an independent lawful basis.
11. International Transfers
Because EBOKIO may use international service providers and technical infrastructure, personal data may be processed outside the United Kingdom or outside the country in which the Publisher is located.
Where personal data is transferred out of the United Kingdom, or out of the European Economic Area for Publishers located there, to a country not covered by adequacy, EBOKIO relies on the following safeguards:
Adequacy: transfers to countries or territories covered by UK adequacy regulations, or by a European Commission adequacy decision, are permitted without additional safeguards; for transfers out of the United Kingdom, the countries of the EEA are covered by UK adequacy regulations. Transfers to organisations in the United States that are self-certified under the EU-US Data Privacy Framework and its UK Extension (the "UK-US data bridge") are also covered by adequacy. Because the status of that framework may change, EBOKIO also puts a contractual safeguard in place as a fallback where appropriate.
Where you accept the Marketing category, data collected by the Meta Pixel is received by Meta Platforms Ireland Limited in the European Union and may be transferred by Meta to the United States and other countries under the safeguards described in Meta's own privacy policy and data transfer terms. Contractual safeguards: for transfers out of the United Kingdom, EBOKIO uses the International Data Transfer Agreement (IDTA) issued by the Information Commissioner's Office, or the European Commission's Standard Contractual Clauses together with the ICO's International Data Transfer Addendum. The EU Standard Contractual Clauses on their own do not cover transfers out of the United Kingdom. For transfers out of the European Economic Area, EBOKIO uses the European Commission's Standard Contractual Clauses.
Transfer risk assessments: where EBOKIO relies on a contractual safeguard rather than adequacy, it will carry out a transfer risk assessment and apply any supplementary technical and organisational measures needed, in line with ICO guidance, before the transfer begins.
Derogations: in exceptional cases only, EBOKIO may rely on a derogation under Article 49 of the UK GDPR or EU GDPR — for example where the Publisher has explicitly consented to a specific transfer, or where the transfer is necessary for a legal claim. These derogations are not used for routine or repeated transfers.
A copy of the safeguard relied on for a particular transfer can be requested at privacy@ebokio.com.
12. Retention of Personal Data
EBOKIO retains personal data only for as long as reasonably necessary for the purposes described in this Policy, including service provision, account administration, payout processing, tax compliance, fraud prevention, rights protection, dispute resolution, security, audit, and the establishment, exercise, or defence of legal claims.
Retention periods may vary depending on the category of data, the nature of the account, the type of transaction, and applicable legal requirements. In particular:
account, transaction, and financial records are retained for the duration of the business relationship and, thereafter, for at least six (6) years from the end of the relevant tax or accounting period, for tax, accounting, audit, fraud-prevention, and legal purposes;
tax and seller-compliance records are retained for at least six (6) years from the end of the relevant tax period, or longer where required by HMRC, applicable law, or regulatory guidance;
content, metadata, and related submission records may be retained after removal or account closure where reasonably necessary for refunds, buyer access, disputes, rights enforcement, fraud prevention, backup integrity, or legal obligations;
moderation, notice, appeal, fraud, and security records may be retained for longer where reasonably necessary to detect repeat abuse, respond to authorities, preserve evidence, or defend claims.
technical, usage, and security data — such as login history, IP addresses, session data, access timestamps, and device and risk signals — is retained for twenty-four (24) months, or longer where reasonably necessary for an active investigation, a legal claim, or a regulatory obligation;
Where personal data is no longer required, EBOKIO will delete, anonymise, de-identify, securely archive, or securely destroy it in accordance with applicable law and internal retention practices.
Account deletion and the 30-day recovery period. If a Publisher closes or deletes their Publisher Account, the account is deactivated immediately and is kept in a restorable state for thirty (30) days, during which the Publisher may restore it and have their account, author profiles, and Works reinstated and relisted. After that period, the account and its associated personal data are permanently deleted or anonymised, except where EBOKIO is required or permitted to retain them for legal, tax, accounting, rights-enforcement, fraud-prevention, or dispute-resolution purposes. A Publisher may instead ask EBOKIO to delete their account and personal data immediately, without waiting for the 30-day period, by contacting privacy@ebokio.com.
13. Security Measures
EBOKIO implements appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful access, loss, misuse, destruction, alteration, or disclosure.
Such measures may include encrypted communications, secure hosting arrangements, access controls, role-based permissions, logging and monitoring, malware scanning, vendor due diligence, authentication controls, backup procedures, incident management processes, and other reasonable security safeguards appropriate to the nature of the data and the risks involved.
Two-factor authentication (2FA) is available for Publisher Accounts. When you enable it, signing in requires a six-digit code from an authenticator application in addition to your password. Because a Publisher Account can be used to access payout and banking details and to manage your Works, EBOKIO strongly recommends that you enable it.
No internet-based or electronically stored system can be guaranteed to be completely secure. Publishers are responsible for maintaining the confidentiality of their account credentials and for notifying EBOKIO promptly of any suspected unauthorised access, account misuse, or security incident affecting their account.
14. Publisher Obligations Regarding Third-Party Personal Data
If a Publisher uploads, submits, or otherwise provides personal data relating to another individual, the Publisher represents and warrants that it has a valid lawful basis to provide that data and that the disclosure does not violate privacy rights, confidentiality obligations, intellectual property rights, contractual duties, or applicable law.
Publishers must not upload unnecessary identity documents, confidential third-party records, unlawfully obtained data, or personal data included in breach of legal, contractual, or fiduciary obligations. EBOKIO may remove, redact, restrict, preserve, or report such material where reasonably necessary.
15. Data Subject Rights
Subject to applicable law, data subjects may have the right to:
be informed about the processing of their personal data;
request access to personal data;
request rectification of inaccurate or incomplete personal data;
request erasure of personal data;
request restriction of processing;
object to certain processing, including processing based on legitimate interests in appropriate circumstances;
request portability of personal data where applicable;
withdraw consent where processing is based on consent;
lodge a complaint with a competent supervisory authority.
not be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects them, and to obtain human review of such a decision.
These rights are not absolute and may be limited where an exemption applies or where continued processing is necessary for compliance with law, fraud prevention, rights protection, legal claims, security, evidence preservation, or the rights and freedoms of others.
To exercise privacy rights, contact privacy@ebokio.com. EBOKIO may request reasonable information to verify identity before acting on a request. Exercising these rights is free of charge, except where a request is manifestly unfounded or excessive, in particular because it is repetitive, in which case EBOKIO may charge a reasonable administrative fee or refuse to act on it and will explain why. EBOKIO will respond without undue delay and within one month of receiving the request, and may extend that period by up to two further months for complex or multiple requests, in which case EBOKIO will inform the Publisher within the first month and explain the reason for the delay.
16. Complaints
If a Publisher has concerns about how EBOKIO handles personal data, the Publisher should first contact EBOKIO using the contact details above so that the matter may be reviewed and, where appropriate, resolved.
If the Publisher is in the United Kingdom, the Publisher may also lodge a complaint with the Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom — www.ico.org.uk — telephone 0303 123 1113 — casework@ico.org.uk. If the Publisher is located elsewhere, the Publisher may have the right to complain to another competent supervisory authority under applicable law. Complaining to a supervisory authority does not require the Publisher to contact EBOKIO first, and does not affect any other legal remedy.
17. Changes to This Policy
EBOKIO may amend, update, replace, or supplement this Policy from time to time to reflect changes in law, regulatory guidance, platform functionality, fraud risks, operational practices, technical infrastructure, service providers, or self-publishing workflows.
Any revised version will be published on the Platform with an updated effective date or last-updated date. Where required by law, EBOKIO will provide additional notice or seek renewed consent before material changes take effect.
18. Governing Law
This Policy shall be governed by and construed in accordance with the laws of England and Wales, without prejudice to any mandatory data protection or consumer rights that apply under applicable law and cannot lawfully be excluded.
Where the Publisher is located in the European Economic Area, the EU General Data Protection Regulation also applies to EBOKIO's processing of the Publisher's personal data in connection with the services offered to them, and nothing in this Policy limits or excludes any right the Publisher has under it.