Who is responsible
Hakuni Ltd, trading as Bokfjord, is the data controller for the personal data described here. We are registered in England and Wales with company number 17140120, and our registered office is at 66 Paul Street, London, England, EC2A 4NA, United Kingdom. Being the controller means we decide what is collected and why, and we are accountable for it under the UK GDPR and the Data Protection Act 2018 — and, for customers in Norway and the rest of the EEA, under the GDPR as it applies there.
For anything about your data, write to hello@bokfjord.com.
The short version
We collect your name, your email address, your billing details and what you have bought. We use them to sell you books, deliver them, and keep the records tax law requires. We do not store passwords, because we do not use them. We never see your card details. We do not sell your data, we do not use advertising or analytics trackers, and we do not send marketing email.
What we collect
- Account data
- Your email address, first name and last name — that is the whole sign-up form. If you add them on your account page, also your phone number and date of birth. There is no password, because we sign you in with a one-time code.
- Billing details
- The name, address, country and, if you give them, company name, tax number and phone number that you enter at checkout. We save them to your account for next time and copy them onto each order, where they determine the VAT and appear on your receipt.
- Order and library data
- What you bought, when, at what price and in what currency, the VAT charged, your order number, the status of the payment, and which books are in your library.
- Payment data
- A payment reference and whether the payment succeeded. Your card details are entered on our payment provider's page and never reach our systems.
- Gift card data
- For gift cards you buy or spend: the amount, the code (stored encrypted), and the date of birth our gift card partner requires. If you buy a gift card without an account, the email address and name you give at checkout.
- Technical and log data
- IP address, browser and device type, and timestamps of requests and sign-in attempts. We use these to keep the shop working and to spot abuse.
- Communications
- Emails and support messages you send us, and our replies.
We do not ask for and do not want special category data — health, beliefs, politics and the like. Please do not send it to us. What you read is not analysed or shared.
Why, and our legal basis
Data protection law requires a lawful basis for each use of your data. Ours are:
| What we do | Data used | Legal basis |
|---|---|---|
| Create and run your account | Account data | Performance of a contract |
| Sign you in with a one-time code | Email, log data | Performance of a contract |
| Take payment and deliver your books | Billing, order and payment data | Performance of a contract |
| Issue, deliver and redeem gift cards | Name, email, date of birth, gift card data | Performance of a contract |
| Send order confirmations, receipts and gift card codes | Account, order and gift card data | Performance of a contract |
| Keep accounting and VAT records | Billing, order and payment data | Legal obligation |
| Answer support requests | Communications, order data | Performance of a contract |
| Prevent fraud and abuse, and keep the shop secure | Technical and log data | Legitimate interests |
Where we rely on legitimate interests, we have weighed those interests against your rights, and we use the least data that achieves the purpose. You can object — see your rights.
Where your data is stored
Our servers, database and file storage are in the European Union. We are a UK company, so the data is also accessed from the United Kingdom; the UK and the EU recognise each other's data protection as adequate. Where a service provider processes data elsewhere, we rely on an adequacy decision or on standard contractual clauses together with any additional safeguards needed. You can ask us for details of the transfers that apply to you.
How long we keep it
| Data | Kept for | Why |
|---|---|---|
| Account data | Until you close your account, then 30 days | To let you undo an accidental closure |
| Orders, receipts, billing and payment records | 6 years from the end of the financial year | Required by UK company and VAT law |
| One-time codes | 10 minutes | They expire, and are stored only in scrambled form |
| Sign-in and security logs | 90 days | Investigating abuse and account takeover |
| Support correspondence | 2 years from the last message | Context for follow-up questions |
Because accounting law requires us to keep order records for six years, we cannot delete a purchase history on request before then — but we can remove the rest of your account and stop all contact.
How we protect it
- Everything travels over encrypted connections (HTTPS).
- There is no password database to steal, because we sign you in with one-time codes that expire after ten minutes and lock after five wrong attempts.
- Card details go straight to our payment provider; we never receive or store them.
- Gift card codes are encrypted in our database.
- Download links are created per request and expire shortly afterwards, so a forwarded link does not hand out your books.
- Access to customer data is limited to people who need it.
If a breach ever puts your rights at risk, we will notify the Information Commissioner's Office, and any other supervisory authority we are required to, within 72 hours, and tell you without undue delay.
Your rights
Under data protection law you can ask us to:
- Give you a copy of the personal data we hold about you;
- Correct anything that is wrong or out of date — most of it you can change yourself on your account page;
- Delete your data, where we are not legally required to keep it;
- Restrict how we use it while a dispute is being resolved;
- Port it — receive it in a structured, machine-readable format, or have it sent to another provider;
- Object to processing based on our legitimate interests.
Write to hello@bokfjord.com. We will respond within one month, and will tell you if we need longer because a request is complex. We may ask you to confirm control of your email address first, so we do not hand your data to someone else. Exercising these rights is free.
If you are not satisfied with how we have handled it, you can complain to the UK Information Commissioner's Office (ico.org.uk) or, if you live in Norway or elsewhere in the EEA, to your local supervisory authority — in Norway, the Norwegian Data Protection Authority (Datatilsynet).
Automated decisions
We do not make decisions about you by automated means alone, and we do not profile you. Our payment provider runs automated fraud checks on transactions; if a payment is declined on that basis you can ask us to look at it, and a person will.
Children
The shop is not aimed at children, and accounts are for people aged 18 or over, or younger buyers with a parent's or guardian's consent. We do not knowingly collect data from children under 13. If you think a child has given us data, write to us and we will delete it.
Changes to this policy
We will update this policy when what we do with data changes. The current version is always here, dated at the top. If a change materially affects you — a new purpose, or a new category of recipient — we will email registered customers at least 30 days beforehand.
How to contact us
Hakuni Ltd, trading as Bokfjord
66 Paul Street, London, England, EC2A 4NA, United Kingdom
Email: hello@bokfjord.com
Phone: +44 7520 657556
We are not required to appoint a Data Protection Officer, and have not appointed one. Privacy requests are handled by a named person on our team.
See also our Terms of Sale and Use, which cover buying and reading.