Privacy policy

Privacy Policy

Quesbo® respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you interact with Quesbo®.

1. Introduction

This Privacy Policy applies when you visit or use a Quesbo website or online shop; browse or purchase products; create or use a customer account; download a digital product or free resource; subscribe to marketing communications; enter a promotion, survey or competition; submit a review, photograph or other content; contact us with an enquiry, complaint or request; or otherwise interact with Quesbo.

It applies to our physical products, printed books, print-on-demand products, digital products, free downloads, games, learning resources and related customer services.

2. Who We Are

Questbound Studios Ltd trading as Quesbo®

Company number: 16413137

Registered in England and Wales

Registered office: 30 Burroughs Crescent, Bourne End, England, SL8 5NR, United Kingdom

Email: contact@quesbo.com

For the purposes of UK data-protection law, Questbound Studios Ltd is generally the controller of the personal information described in this Privacy Policy. This means that we decide why and how that personal information is used.

Some organisations that support our business, such as payment providers, delivery companies and certain technology providers, may act as independent controllers for their own use of personal information. Their own privacy information will apply to that processing.

3. A Summary of How We Use Personal Information

 operate our websites and online shop;

 process and fulfil orders;

 arrange payment, production and delivery;

 provide digital products and free resources;

 communicate with customers;

 administer accounts, refunds, returns and complaints;

 prevent fraud and protect our services;

 meet legal, tax and accounting obligations;

 improve our products, websites and customer experience;

 send marketing where permitted; and

 establish, exercise or defend legal claims.

We do not require customers to agree to marketing in order to purchase a product or obtain a free resource.

4. Personal Information We May Collect

The personal information we collect depends on how you interact with us.

4.1 Identity and contact information

name; title or form of address; email address; telephone number; billing address; delivery address; country or region; account contact information; and other contact details that you provide.

4.2 Order and transaction information

products viewed, selected or purchased; order numbers; order dates and values; discount codes and promotions; billing and delivery information; delivery status and tracking information; digital-download information; transaction references; returns, cancellations and refunds; customer-service records; product reviews; and order-related correspondence.

4.3 Payment information

Payments made through our online shop are processed by Shopify Payments or other payment providers made available through checkout. We do not normally receive or store your complete payment-card number, card security code or full payment credentials ourselves.

We may receive limited payment-related information such as payment status, payment method, transaction reference, fraud-screening outcome, the last digits of a payment card where made available, refund information and billing confirmation.

4.4 Customer-account information

If customer accounts are available and you create or use an account, we may process account contact details, delivery addresses, order history, permitted preferences, saved shopping information, account activity and authentication or security information made available to us by the account service.

4.5 Communications and customer-service information

This may include emails and contact-form messages; enquiries and support requests; complaints and dispute information; order numbers and evidence supplied in support of a request; feedback and survey responses; telephone-call details or notes where applicable; social-media correspondence; and information required to verify identity or authority.

Please do not send us sensitive or unnecessary personal information when contacting us.

4.6 Marketing and communication information

Where you subscribe to or interact with Quesbo marketing, we may collect your name and email address, subscription date and source, marketing preferences, consent records, unsubscribe or objection records, messages sent to you, and engagement information such as delivery, opens or link selections where our communication tools provide that functionality and its use is lawful.

4.7 Website, device and usage information

When you visit our websites or online shop, we and our technology providers may collect technical information including IP address; browser and device information; operating system; language and region settings; approximate location derived from technical data; date, time and duration of visits; pages, products and links viewed; referring website or marketing source; shopping-cart and checkout interactions; account and session information; cookie or similar identifiers; and error, security and performance information.

The exact information collected depends on the Shopify features, applications, cookies and other technologies operating on our shop.

4.8 Reviews, photographs and user-submitted content

If you submit a review, photograph, testimonial, competition entry or other content, we may collect your name or display name, the content, photographs or videos, product information, date of submission, permission and publication preferences, and related correspondence.

Please do not submit photographs or information about another person, particularly a child, unless you have the appropriate authority and permission to do so.

4.9 School, retailer, supplier and business-enquiry information

If you contact us on behalf of a school, retailer, organisation, supplier or potential business partner, we may collect your name, work contact details, job title, organisation name, enquiry details, wholesale or purchasing requirements, order and invoicing information and related correspondence.

4.10 Gift-recipient information

Where a customer asks us to deliver a product to another person, we may receive that person's name, address and relevant delivery information from the customer. If you provide another person's personal information, you should ensure that you are authorised to provide it and that the person understands how it will be used.

4.11 Special-category information

We do not normally seek or need information concerning health, race or ethnicity, religious or philosophical beliefs, political opinions, trade-union membership, genetics, biometrics, sex life or sexual orientation. Please do not provide this type of information unless it is genuinely necessary. Where we are required to process sensitive information, we will only do so where an appropriate lawful basis and condition apply.

5. How We Collect Personal Information

 directly from you;

 when you place or attempt to place an order;

 when you create or use an account;

 when you contact us;

 when you subscribe to communications;

 when you request a free resource;

 when you submit a review or other content;

 automatically through cookies and similar technologies;

 from Shopify and Shopify services;

 from payment and fraud-prevention providers;

 from printing, production and fulfilment providers;

 from delivery and postal providers;

 from digital-delivery providers;

 from email and customer-communication providers;

 from analytics or advertising providers where lawfully used;

 from social-media platforms where you interact with us;

 from another customer, such as where you are a gift recipient; and

 from professional advisers, authorities or publicly available sources where appropriate and lawful.

6. Why We Use Personal Information and Our Lawful Bases

We only process personal information when we have an appropriate lawful basis. Depending on the activity, we may rely on performance of a contract; steps requested before entering into a contract; compliance with a legal obligation; our legitimate interests or those of another party; your consent; or another lawful basis available under applicable law.

6.1 Processing and fulfilling orders

We use personal information to accept and administer orders, process payments, produce or prepare products, provide digital products, arrange printing or fulfilment, arrange delivery, provide tracking information, communicate about an order, process cancellations, returns and refunds, and provide after-sales support. Our lawful basis is generally that processing is necessary to perform our contract with you or take steps at your request before entering into a contract.

6.2 Providing digital products and free resources

Where you request a digital product or free resource, we may use your information to provide access, send a download link, confirm delivery, provide technical assistance, prevent misuse and respond to related enquiries. Requesting a free resource does not, by itself, mean that you have agreed to receive marketing. Where we invite you to subscribe to marketing at the same time, marketing consent will be presented separately where required.

6.3 Providing customer service

We use personal information to answer enquiries, resolve delivery or product problems, investigate complaints, verify orders, administer guarantees or legal rights, provide product guidance and maintain a record of our response. The lawful basis may be performance of a contract, compliance with a legal obligation or our legitimate interest in providing effective customer service and managing our relationship with customers.

6.4 Managing customer accounts

We may process account information to create and administer accounts, provide access to order history, save permitted preferences, authenticate users, prevent unauthorised access and respond to account-related enquiries. The lawful basis may be performance of a contract or our legitimate interest in providing and protecting customer-account functionality.

6.5 Preventing fraud and protecting our business

We may process information to prevent fraudulent transactions, identify suspicious activity, protect customer accounts, protect our websites and systems, investigate misuse, enforce our terms, manage chargebacks, maintain service availability and protect the rights, property and safety of Quesbo, our customers and others. Our lawful basis may be our legitimate interests or compliance with a legal obligation.

6.6 Meeting legal, regulatory, tax and accounting obligations

We may process and retain personal information where necessary to maintain company and accounting records, comply with taxation and consumer-protection requirements, administer product-safety obligations, respond to legal claims, comply with court orders, cooperate with regulators or law-enforcement authorities and meet other applicable legal obligations. Our lawful basis is compliance with a legal obligation or, where appropriate, our legitimate interest in managing and defending our legal position.

6.7 Improving our websites, products and services

We may use information to understand how customers use our websites, identify technical problems, measure performance, improve navigation and checkout, understand product interest, develop new products and resources, assess feedback, improve support and measure the effectiveness of promotions.

Our lawful basis may be our legitimate interests. Where cookies or similar technologies require consent, we will request consent before using them.

6.8 Marketing

Where permitted, we may send information about Quesbo products, games and books, creative and learning resources, new releases, free activities, special offers, events, competitions, promotions and Quesbo news. We will only send electronic marketing where you have provided valid consent or another basis permitted by applicable electronic-marketing law applies, such as an existing-customer exception for similar products where all relevant conditions are met. You can unsubscribe at any time using the unsubscribe link in a marketing email or by contacting us. Withdrawing consent or unsubscribing from marketing does not prevent essential service communications. We may retain a minimal suppression record so that we can respect your preference.

6.9 Reviews, testimonials and customer content

Where you submit a review or other content, we may administer the submission, verify that it relates to a genuine product interaction, publish or moderate it, respond to feedback and promote our products where you have authorised that use. The lawful basis may be your consent or our legitimate interest in collecting and publishing genuine customer feedback. We will seek appropriate permission before using identifiable photographs or other content beyond the context in which they were submitted.

6.10 Business enquiries and professional relationships

We may use business-contact information to respond to retailer, school or wholesale enquiries, discuss collaborations, manage suppliers and service providers, prepare quotations, negotiate and administer agreements and maintain professional relationships. The lawful basis may be steps requested before entering into a contract, performance of a contract or our legitimate interests in operating and developing our business.

7. Our Legitimate Interests

Where we rely on legitimate interests, those interests may include operating and developing Quesbo; providing effective customer service; improving our products and websites; understanding customer demand; maintaining accurate business records; protecting customers, accounts and systems; preventing fraud and misuse; managing business relationships; recovering money owed; managing complaints and disputes; and establishing, exercising or defending legal claims.

We consider whether our interests are necessary and proportionate and whether your interests, rights or freedoms override them. You may have the right to object to processing based on legitimate interests, as explained below.

8. Information You Must Provide

Certain personal information is required to enter into or perform a contract with you. For example, to place and fulfil an order we normally need your name, contact information, billing information, delivery information where applicable and the payment information required by the payment provider.

If you do not provide information required to process an order, we may be unable to accept, fulfil or deliver it. Providing information for marketing is optional.

9. How We Share Personal Information

We may share personal information with the following categories of recipient where reasonably necessary and lawful.

9.1 Shopify

Our online shop is operated using Shopify. Shopify provides ecommerce technology used to host our store, support checkout, process store activity, maintain customer accounts and provide associated services. Shopify may process information as our service provider and, for certain activities or services, as an independent controller. Further information is available through Shopify's own privacy information.

9.2 Payment and financial-service providers

We may share information with payment processors, banks, card networks, digital-wallet providers, fraud-prevention services and chargeback or payment-dispute providers so they can authorise payments, prevent fraud, process refunds and comply with financial laws.

9.3 Printing, production and fulfilment providers

Some products may be printed, produced or fulfilled by third parties. We may provide them with customer or recipient name, delivery address, contact information where necessary, product and order details, packaging or delivery instructions and order reference.

9.4 Delivery and postal providers

We may share relevant information with couriers, postal operators and delivery partners so they can collect and deliver orders, provide tracking, contact a recipient about delivery, manage failed delivery attempts and investigate lost or damaged parcels.

9.5 Digital-product and download providers

Where we use a service to deliver a digital product or free resource, that provider may receive information required to provide the download, authenticate access, send a delivery email, record successful delivery and prevent unauthorised use.

9.6 Technology and communication providers

We may use providers that support website hosting, ecommerce, customer accounts, email delivery, customer communications, data storage, website security, fraud prevention, analytics, advertising where lawfully enabled, reviews, surveys, customer support and business administration. These providers may process information on our behalf or, depending on the service, for their own stated purposes.

9.7 Professional advisers

We may share information with accountants, insurers, banks, legal advisers, auditors, tax advisers and other professional advisers where reasonably necessary.

9.8 Public authorities and legal recipients

We may disclose information where reasonably necessary to comply with law, respond to a court order, cooperate with law-enforcement authorities or a regulator, protect a person's safety, investigate fraud or unlawful activity, or establish, exercise or defend legal claims.

9.9 Business transfers

If Questbound Studios Ltd or part of its business is sold, reorganised, merged, financed or transferred, personal information may be disclosed to professional advisers, potential purchasers, lenders or relevant parties, subject to appropriate confidentiality and data-protection requirements.

10. Sale, Sharing and Targeted Advertising

We do not sell personal information in exchange for money.

Where applicable privacy laws treat certain advertising or analytics disclosures as a form of "sale", "sharing" or targeted advertising, we will provide any privacy choices, opt-out mechanisms or recognised preference-signal handling required by applicable law.

11. Cookies and Similar Technologies

Our websites may use cookies, pixels, local storage and similar technologies to operate the website and checkout, maintain shopping-cart functionality, authenticate accounts, remember preferences, provide security, prevent fraud, understand website performance, analyse website usage, measure marketing effectiveness and support advertising where permitted.

11.1 Strictly necessary technologies

Some technologies are necessary for the website, shopping cart, checkout, account, security or requested service to function. These cannot always be disabled through our consent tool because the service may not work correctly without them.

11.2 Preference technologies

These may remember choices such as region, language, currency or display preferences.

11.3 Analytics technologies

These may help us understand how visitors use our websites and how the websites perform. Where consent is required, these technologies will not be used until valid consent has been obtained.

11.4 Advertising technologies

Where enabled, these technologies may help measure advertising, limit repeated advertisements or present advertising that may be more relevant to visitors. Where consent or an opt-out right is required, we will provide the relevant privacy controls.

11.5 Managing cookie choices

You can manage available cookie choices through the cookie banner or Cookie Preferences link on our website. You may also manage cookies through your browser settings. Blocking some cookies may affect website, cart, account or checkout functionality. Withdrawing consent does not affect processing that lawfully took place before the withdrawal.

12. International Transfers

Shopify and some of our payment, technology, communication, printing, fulfilment, analytics or delivery providers may process personal information outside the United Kingdom or the country in which you live.

Where international-transfer rules apply, we will take appropriate steps designed to protect personal information. Depending on the circumstances, these may include an applicable adequacy decision or regulation, approved standard contractual clauses, the United Kingdom International Data Transfer Agreement, the United Kingdom Addendum to approved European contractual clauses, appropriate transfer-risk assessments or other lawful safeguards.

International transfers made by an independent controller may be governed by that organisation's own privacy information and transfer arrangements. You may contact us for further information about safeguards relevant to personal information that we control.

13. How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, tax, accounting, regulatory, security and dispute-resolution requirements.

13.1 Order and financial records

Order, payment, refund, delivery, invoice and accounting records will normally be retained for the period required by applicable company, tax and accounting law, which will commonly be at least six

years for relevant UK business records.

13.2 Customer-service enquiries

Routine enquiries that do not result in an order or dispute will normally be retained for no longer than two years after the enquiry is closed, unless a longer period is reasonably required.

13.3 Complaints, returns and legal disputes

Records relating to complaints, returns, disputes, chargebacks, safety matters or legal claims may be retained for up to six years after the matter is resolved, or longer where required by law or an ongoing claim.

13.4 Customer accounts

Account information may be retained while an account remains active. Where account information is connected to purchases or legal records, relevant information may be retained for the applicable order, tax, dispute or accounting period after the account is closed.

13.5 Marketing information

Marketing information may be retained until you unsubscribe, withdraw consent or we determine that it is no longer reasonably required. We may retain a minimal suppression record after an unsubscribe request so that we can continue to respect your preference.

13.6 Reviews and published content

Reviews or other published content may remain available while relevant to the product or service. We may retain an internal record of the submission and permission for a reasonable period after publication ends or the content is removed.

13.7 Website and security information

Where we control the retention period, website logs and security information will normally be retained only for the period reasonably required for website operation, security, troubleshooting, analytics or fraud prevention. Third-party technology providers may apply their own documented retention periods.

When personal information is no longer required, we will delete it, anonymise it or securely dispose of it where reasonably practicable. We may retain anonymised information that can no longer identify an individual.

14. Security

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, misuse, alteration, disclosure and destruction. Measures may include secure ecommerce and payment services, encryption in transit where supported, restricted access, account and access controls, authentication protections, security monitoring, reputable service providers, backups and incident-management procedures.

No website, transmission method or storage system can be guaranteed to be completely secure. Where required, we will investigate personal-data breaches and notify affected individuals and the relevant regulator in accordance with applicable law.

You are responsible for keeping your account credentials confidential and for contacting us if you suspect that an account or communication has been compromised.

15. Children's Privacy

Quesbo creates books, games, activities and learning products that are designed for children and families, and we recognise that children may visit our website or view our content.

Our online shop, checkout, customer accounts and marketing subscription services are intended to be used by adults or with appropriate parent or guardian involvement.

We do not ask children to provide more personal information than is reasonably necessary for the relevant service.

Where an online service is offered directly to a child and we rely on consent as the lawful basis for processing personal information, a child under 13 cannot provide that consent independently under UK data-protection law. Where required, we will seek appropriate consent or authorisation from a person with parental responsibility and take reasonable steps to verify that authorisation.

Children should not independently place an order, create a customer account, subscribe to marketing, submit photographs or other personal content, or provide payment information without appropriate parent or guardian involvement.

Where children are likely to access an online service provided by Quesbo, we will take their age, understanding and best interests into account when designing how personal information is collected and used.

If you are a parent or guardian and believe that a child has provided personal information to us inappropriately, please contact us at contact@quesbo.com. We will investigate and take appropriate action.

16. Automated Decision-Making

We do not normally make decisions about customers based solely on automated processing where the decision produces legal effects or similarly significant effects.

Shopify, payment providers and fraud-prevention providers may use automated systems to assess transactions, detect fraud, protect accounts, authorise payments or identify security risks. Where a provider acts independently, its own privacy information will explain its processing.

Where applicable law gives you rights concerning a significant decision made solely through automated processing, you may request information, express your view, challenge the decision or request human involvement.

17. Your Data-Protection Rights

17.1 Right of access

You may ask whether we process your personal information and request access to the personal information we hold about you.

17.2 Right to rectification

You may ask us to correct inaccurate personal information or complete information that is incomplete.

17.3 Right to erasure

You may ask us to delete personal information in certain circumstances. This right is not absolute, and we may need to retain information where required by law, for accounting or tax purposes, to prevent fraud, resolve disputes or establish, exercise or defend legal claims.

17.4 Right to restrict processing

You may ask us to restrict how we use personal information in certain circumstances.

17.5 Right to data portability

Where processing is automated and based on consent or a contract, you may have the right to receive certain information you provided to us in a structured, commonly used and machine-readable format, or ask us to transfer it to another controller where technically feasible.

17.6 Right to object

You may object to processing based on legitimate interests in certain circumstances. We may continue processing where the law allows us to do so, including where we can demonstrate compelling lawful grounds or processing is required for legal claims.

17.7 Absolute right to object to direct marketing

You have an absolute right to object to the use of your personal information for direct marketing. When you object, we will stop using your information for that purpose. We may retain a minimal suppression record to ensure your preference continues to be respected.

17.8 Right to withdraw consent

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn.

17.9 Rights concerning automated decision-making

Where applicable, you may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

17.10 Right to complain

You have the right to complain to us about how we use personal information and to make a complaint to the relevant data-protection supervisory authority.

Rights may be subject to legal conditions, limitations or exemptions.

18. How to Exercise Your Rights

To make a data-protection request, email contact@quesbo.com or write to Questbound Studios Ltd, trading as Quesbo®, 30 Burroughs Crescent, Bourne End, England, SL8 5NR, United Kingdom.

Please clearly explain the right you wish to exercise, the personal information or activity concerned, your name and contact information, any relevant order or account number, and any information that may help us locate the relevant records.

We may request reasonable evidence of identity or authority before disclosing, changing or deleting personal information. We will not request more information than reasonably necessary for verification.

Data-protection requests are normally handled without charge. A reasonable fee may be permitted where a request is manifestly unfounded or excessive, or where additional copies are requested.

We will normally respond without undue delay and within one month after receiving a valid request and any reasonably required verification information. Where permitted by law, this period may be extended for complex or numerous requests; if so, we will tell you and explain the reason.

19. Data-Protection Complaints

You may complain to us if you believe that we have not handled your personal information properly.

Email contact@quesbo.com with the subject line "Data Protection Complaint" or write to our registered office.

We aim to acknowledge a complaint within five working days, take appropriate steps to investigate without undue delay, keep you reasonably informed of progress and communicate the outcome without undue delay.

We may ask for additional information or reasonable proof of identity where needed to investigate safely and fairly.

20. Complaining to a Supervisory Authority

We would appreciate the opportunity to address your concern directly first. However, you also have the right to complain to a data-protection supervisory authority.

In the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO). Current contact details, guidance and the online complaint process are available on the ICO website.

If you are located in the European Economic Area, you may also have the right to complain to the data-protection authority in the country where you live, work or believe an infringement occurred.

21. Additional Rights in Other Countries

Customers in some countries, provinces or US states may have additional privacy rights, which may include rights to know, access, correct, delete or receive a portable copy of personal information, and rights to opt out of certain targeted advertising, sale or sharing activities.

Where applicable law grants these rights, we will process valid requests in accordance with that law. We will not unlawfully discriminate against you for exercising an applicable privacy right.

22. Third-Party Websites and Services

Our websites may contain links to other websites, platforms or services that we do not control. Those organisations may collect and use personal information under their own privacy policies. We are not responsible for the privacy practices, security or content of third-party services. We encourage you to review the privacy information of a third party before providing personal information to it.

23. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our products or services, technology or service providers, data practices, legal or regulatory developments, or improvements to clarity. The latest version will be published on our website with an updated revision date. Where a change materially affects how we use personal information, we will take reasonable steps to provide additional notice where required.

24. Contact Us