Privacy Policy

Last updated: 8 Aug 2026

Epic Storytelling Ltd, trading as Epic Tales, is the controller responsible for the personal information described in this notice.

Our details are:

Epic Storytelling Ltd
Trading as Epic Tales
Company number: 11867069
Registered office: 29 Watnall Road, Hucknall, Nottinghamshire, NG15 7LD
Privacy enquiries: privacy@epictales.co.uk

In this notice, “Epic Tales”, “we”, “us” and “our” mean Epic Storytelling Ltd.

This notice explains how we collect, use, store, and share personal information in connection with:

• the Epic Tales website and online shop;
• book orders, deliveries and customer service;
• storytelling performances, school visits, workshops, and events;
• editing, coaching, and other professional services;
• competitions and complimentary school visit promotions;
• community, educational, and publishing projects;
• manuscript, illustration, and other creative submissions;
• newsletters, business development, and marketing;
• authors, illustrators, storytellers, freelancers, and other suppliers;
• recorded online meetings;
• our relationships with schools, libraries, bookshops, publishers, sponsors, event organisers, and other partners; and
• general enquiries and correspondence.

This notice applies whether you contact us through our website, by email, by telephone, through social media, at an event, or through another organisation.

The personal information we collect depends on how you interact with us.

Identity and contact information

This may include:

• your name;
• job title and organisation;
• postal address;
• email address;
• telephone number;
• school, library, business, or other organisation;
• parent, guardian, or responsible adult details; and
• usernames or social-media account details where you contact us through those services.

Order and transaction information

When you buy from us or arrange a paid service, we may collect:

• billing and delivery addresses;
• products or services ordered;
• prices, discounts, and coupon codes;
• payment status;
• delivery and fulfilment information;
• order notes;
• invoices and accounting records;
• correspondence concerning the order; and
• information needed to prevent or investigate fraud.

Payments are processed by Stripe, WooPayments, or the relevant digital-wallet provider, such as Apple Pay, Google Pay, or Link. Epic Tales does not receive or store your complete payment card details.

Enquiry, booking and professional information

This may include:

• details of an enquiry or proposed booking;
• quotations and contractual arrangements;
• event dates, locations, audiences, and access requirements;
• previous dealings with Epic Tales;
• correspondence and notes relating to a booking or project;
• information about the organisation you represent;
• referrals and introductions; and
• records of completed, cancelled, or unsuccessful enquiries.

Marketing information

This may include:

• whether you have subscribed to Epic Rewards or another mailing list;
• your marketing preferences;
• when and how your details were obtained;
• records of consent or an opt-out;
• email delivery, opening, and link-click information where such measurement is enabled and legally permitted;
• device type and approximate location derived by our email provider; and
• records showing that you must not be contacted.

Website and technical information

When you visit our website, our systems and service providers may collect:

• your IP address;
• browser and device type;
• operating system;
• referring website;
• pages viewed and actions taken;
• dates and times of visits;
• cookie identifiers;
• approximate location derived from your IP address;
• security and anti-spam information; and
• diagnostic or error information.

Some of this information is collected through cookies and similar technologies.

Creative work and uploaded material

Where relevant, we may receive:

• manuscripts;
• illustrations and artwork;
• photographs;
• audio or video;
• competition entries;
• receipts or order confirmations uploaded as evidence of a qualifying purchase;
• reviews, testimonials, or endorsements; and
• other materials submitted for consideration, publication, or use in a project.

Please remove or obscure payment card numbers, bank details, and unrelated personal information before uploading a receipt or order confirmation.

Recordings

We may record a Google Meet or another online meeting when the participants have been told about the recording and have agreed to it.

Recordings may include participants’ names, voices, images, contributions, and any information shown or discussed during the meeting.

Information about children

Where children participate in a competition, publishing project, recording, performance, or other activity, we may receive:

• a child’s first name;
• their school, group, or age range;
• their writing, artwork, voice, or performance;
• photographs or video;
• information supplied by a parent, guardian, school, or organiser; and
• information needed to administer permission, accessibility, or safeguarding.

We generally avoid publishing a child’s surname. However, a first name combined with a school, photograph, recording, project, or other context may still make the child identifiable and is therefore treated as personal information.

Freelancer and supplier information

For authors, illustrators, storytellers, editors and other freelancers or suppliers, we may collect:

• professional and contact details;
• contracts, fees, invoices and payment information;
• tax or accounting information;
• biographies, photographs, credits and examples of work;
• availability and project records; and
• limited health, disability, dietary or accessibility information where needed to make appropriate arrangements.

We do not intentionally collect sensitive information unless it is relevant and necessary.

We may obtain information…

…directly from you

For example, when you:

• submit a website form;
• place an order;
• subscribe to a mailing list;
• upload a receipt or competition entry;
• contact us by email, telephone, or social media;
• make or receive a booking;
• attend a meeting or event;
• submit creative work;
• enter into a contract with us; or
• provide services to us.

…automatically

Some technical information is collected automatically when you use our website, open or interact with an email, submit an online form, or use an embedded service.

…from other people and organisations

We may also obtain information from:

• a parent or guardian;
• a school, library, or event organiser;
• a bookshop, publisher, distributor, or sponsor;
• an author, illustrator, storyteller, freelancer, or other partner;
• someone making a referral or introduction;
• previous correspondence and historic booking records;
• publicly available professional sources, such as an organisation’s website;
• professional directories;
• social-media pages used for professional purposes; and
• service providers involved in payments, deliveries, website security, or administration.

When we use publicly available or third-party information for professional outreach, we limit this to information relevant to the person’s professional role.

We must have a lawful basis for each way in which we use personal information. The bases most relevant to our work are contract, legal obligation, legitimate interests, and consent.

Responding to enquiries and entering into contracts

We use information to:

• respond to questions;
• discuss possible bookings or services;
• prepare quotations;
• assess whether we can undertake a project;
• negotiate and enter into contracts; and
• maintain relevant correspondence.

Our lawful basis is normally that the processing is necessary to take steps at your request before entering into a contract, to perform a contract, or for our legitimate interests in responding to professional and business enquiries.

Supplying products and services

We use information to:

• process and deliver orders;
• provide storytelling, publishing, editing, coaching, and related services;
• administer bookings, visits, projects, and events;
• communicate about arrangements;
• manage cancellations, complaints, refunds, and other customer service matters; and
• maintain records of what we supplied.

Our lawful basis is normally performance of a contract, compliance with legal obligations, and our legitimate interests in operating and administering our business.

Competitions and school-visit promotions

We use entry information to:

• verify qualifying purchases;
• administer competitions and prize draws;
• contact entrants;
• identify and contact nominated schools;
• arrange prizes and school visits;
• prevent duplicate, invalid, or fraudulent entries; and
• publicise winners where appropriate permission has been obtained.

Our lawful basis may be performance of the competition terms, our legitimate interests in running and protecting the promotion, and consent where publication or optional promotional use is involved.

Publishing and creative projects

We may use submitted writing, artwork, photographs, recordings, or other creative material to:

• assess it;
• develop or administer a project;
• edit, design, publish, or distribute agreed work;
• credit contributors;
• promote a publication or project; and
• preserve appropriate project records.

Our lawful basis may be contract, legitimate interests, or consent, depending on the project and the use concerned.

Separate permission or contractual terms may be used for publication, recording, photography, and promotional use.

Recorded meetings

We use meeting recordings to:

• keep an accurate record;
• support an editing, coaching, or creative process;
• allow participants to revisit advice or decisions; and
• administer the relevant service.

We record meetings only after notifying participants and obtaining agreement. Where we rely on consent, consent may be withdrawn for future processing, although withdrawal does not affect processing that was lawful before withdrawal or information we must retain for another lawful reason.

Accounting and legal compliance

We use information to:

• issue and process invoices;
• maintain financial and tax records;
• work with our accountant and Sage;
• comply with company, tax, consumer protection, and other legal obligations;
• respond to regulators, courts, or law-enforcement bodies;
• establish, exercise, or defend legal claims; and
• prevent or investigate fraud or misuse.

Our lawful bases are legal obligation and our legitimate interests in protecting our business and legal position.

Operating and protecting our website and systems

We use information to:

• operate our website and online shop;
• process forms;
• identify and block spam, fraud, and malicious activity;
• troubleshoot problems;
• secure accounts, systems, and information;
• create backups;
• understand general website performance; and
• improve our services and communications.

Our lawful bases are our legitimate interests in maintaining a secure, functional, and effective website and, where non-essential cookies or similar technologies are involved, consent.

Maintaining business and booking history

We maintain records of enquiries, bookings, projects, clients, and professional relationships to:

• understand previous dealings;
• provide continuity when an organisation contacts us again;
• avoid repeating previous discussions;
• evidence services and arrangements;
• assess the suitability and history of future bookings;
• support long-term relationship management; and
• preserve an appropriate history of Epic Tales’ professional activities.

We rely on our legitimate interests in effective business administration, preserving relevant professional history, and managing repeat relationships.

We balance these interests against the rights and reasonable expectations of the people concerned and limit access to the records.

Safeguarding, accessibility and safety

Where necessary, we may use limited information to:

• make reasonable accessibility arrangements;
• protect the welfare of a child or vulnerable person;
• respond to a safeguarding concern;
• protect someone’s vital interests; or
• comply with a legal or professional obligation.

The applicable lawful basis will depend on the circumstances. Where sensitive information is involved, we will also identify an appropriate additional condition for processing it.

Epic Rewards and other opt-in newsletters

We send Epic Rewards and similar consumer newsletters to people who have actively subscribed.

Our lawful basis is consent. Subscribers can withdraw consent at any time by using the unsubscribe facility in an email or contacting privacy@epictales.co.uk.

Existing customers

Where the law permits, we may contact existing customers about Epic Tales products or services similar to those they previously purchased or discussed with us.

We do this only where the applicable existing customer rules have been satisfied, including where:

• we obtained the contact details in connection with a sale or genuine sales negotiation;
• the marketing concerns our own similar products or services;
• the person was offered a clear opportunity to opt out when the details were collected; and
• every subsequent message includes an easy way to opt out.

Our data-protection lawful basis is normally legitimate interests.

A previous purchase alone does not necessarily give us permission to send marketing.

Schools and professional contacts

We may contact schools, libraries, bookshops, publishers, event organisers, sponsors, and other organisations about products, visits, projects, and services that appear relevant to their work.

We may use professional contact details obtained through previous correspondence, referrals, publicly available professional sources, or the organisation itself.

Our lawful basis is normally our legitimate interests in promoting relevant services, building professional relationships, and developing our business.

We take account of the nature of the recipient, their reasonable expectations, and whether the communication is relevant to their professional role.

Telephone marketing

We may make live promotional telephone calls where legally permitted. We do not call anyone who has objected, and we take account of applicable telephone preference services.

Email measurement

Our email provider may record whether an email was delivered or opened, whether a link was selected, the device used, and an approximate location.

We use this information to assess whether communications are useful and to improve future messages. We use tracking technologies only where legally permitted, and obtain consent where consent is required.

Opting out

You may object to direct marketing at any time. Every marketing email should provide an unsubscribe or opt-out method.

When someone opts out, we may retain the minimum information necessary on a suppression or ‘Do Not Contact’ list. This ensures that the person is not accidentally added to a future campaign.

You have an absolute right to object to the use of your personal information for direct marketing. Once you object, we will stop using your information for that purpose.

We do not currently send marketing by SMS, WhatsApp, or post. We will update our practices and privacy information before introducing any materially different marketing activity.

Our books, storytelling, and educational activities are intended largely for the benefit of children, but children should not provide personal information to us through website forms, purchases, competition entries, or mailing list registrations without the involvement and permission of a parent or guardian.

Where a child participates in a project or activity:

• we collect only the information reasonably needed;
• permission may be managed by Epic Tales, a parent or guardian, a school, or an event organiser, depending on the activity;
• we expect schools and organisers sharing children’s information with us to have the authority and appropriate permissions to do so;
• we generally use first names rather than full names in public-facing work;
• we do not use children’s information for behavioural advertising;
• we do not intentionally send direct marketing to children; and
• we consider the child’s interests and welfare when deciding how information may be used.

A school, organiser, and Epic Tales may each be independently responsible for different uses of the same information. Questions about information originally collected by a school or organiser may therefore need to be directed to that organisation as well as to us.

Where a child’s work, first name, photograph, image, voice, or contribution is included in a printed book, recording, website, publicity material, or other publication, we will explain the intended use when permission is obtained.

It may not be possible to remove personal information completely from printed books already sold, physical materials already distributed, or copies lawfully held by other people. We will nevertheless consider reasonable requests concerning future use and material under our control.

We share personal information only where reasonably necessary for the purposes described in this notice.

Recipients may include:

• SiteGround and other website-hosting, backup and security providers;
• WordPress, Divi, WooCommerce, WPForms, and associated website service providers;
• Stripe, WooPayments, Apple Pay, Google Pay, Link, and other payment providers;
• MailerLite and other email delivery providers;
• Google Workspace, Gmail, Google Drive, Google Meet, YouTube, reCAPTCHA, and related Google services;
• CookieYes and other cookie-preference providers;
• Sage, our accountant, and professional financial advisers;
• Royal Mail and other couriers selected by Epic Tales;
• printers, publishers, distributors, or fulfilment providers;
• authors, illustrators, storytellers, editors, and other freelancers involved in a booking or project;
• schools, libraries, bookshops, sponsors, publishers, and event organisers;
• insurers, banks, legal advisers, and other professional advisers;
• regulators, HM Revenue & Customs, courts, law enforcement bodies, or public authorities where required; and
• a purchaser, investor, or professional adviser involved in a possible sale, restructuring, or transfer of all or part of our business.

Some recipients process personal information on our instructions. Others, such as payment providers, professional advisers, or partner organisations, may act as independent controllers for their own use of the information.

We provide each recipient only with information reasonably needed for their role.

We do not sell or rent personal information, and we never give it to another organisation for that organisation’s unrelated marketing.

Epic Tales is based in the United Kingdom, but some service providers operate internationally or store and process information outside the UK. We may also work with clients, contributors, or suppliers in other countries.

Where personal information is transferred outside the UK, we take reasonable steps to ensure that the transfer is lawful. Depending on the destination and provider, this may include:

• transferring information to a country covered by UK adequacy regulations;
• relying on an approved international data-transfer agreement or contractual addendum;
• using a provider covered by an applicable UK-approved certification or data bridge;
• carrying out an appropriate transfer assessment; or
• relying on another legally permitted safeguard or exception.

You may contact privacy@epictales.co.uk for further information about the safeguards relevant to a particular transfer.

Our website uses cookies and similar technologies.

Some are strictly necessary for functions such as:

• website security;
• shopping baskets and checkout;
• remembering cookie preferences;
• processing forms;
• fraud prevention; and
• maintaining website sessions.

Other technologies may be used for:

• analytics;
• measuring website performance;
• embedded YouTube videos;
• email measurement;
• anti-spam services such as reCAPTCHA; and
• improving website content.

Where consent is legally required, non-essential technologies should not be activated until consent has been given.

Our cookie banner and preference tool are provided through CookieYes. Visitors can use the available cookie settings to accept, reject, or manage non-essential cookies.

Embedded services and external content may receive technical information such as an IP address, browser information, and details of the page being viewed. The provider’s own privacy terms may also apply.

Further information about the particular cookies currently detected on the website should be provided through our cookie banner or cookie declaration.

Our website and communications may contain links to websites, social-media platforms, or services operated by other organisations.

Those organisations are responsible for their own privacy practices. This notice does not govern information collected after you leave our website or interact directly with another organisation’s service.

Information sent through a public social media page may be visible to other users. Please do not send sensitive or confidential information through a public post or comment.

We keep personal information only for as long as we reasonably need it for the purpose for which it was collected, including legal, contractual, accounting, and dispute resolution requirements.

Our general retention approach is…

…orders, contracts, invoices, and financial records

We normally retain these for up to seven years after the relevant transaction, financial year, or business relationship ends.

…client, project, supplier and freelancer records

We normally retain contractual, payment, and project records for up to seven years after the relationship or project ends, unless a longer period is reasonably needed for a legal claim, continuing publication, or other documented purpose.

…general enquiries and unsuccessful submissions

We normally retain these for up to two years after the last meaningful contact, unless they form part of a continuing relationship or there is a reason to keep them longer.

…booking enquiries and booking records

We may retain booking enquiries and booking records for the life of the business.

These records form part of Epic Tales’ long-term professional history and may be needed to understand previous dealings, manage repeat relationships, evidence services, assess future enquiries, and maintain continuity.

We periodically review these records and may delete or anonymise information that has become irrelevant, excessive, or no longer useful.

…competition and promotional-entry information

We normally retain entries and uploaded purchase evidence for up to two years after the competition, prize, or associated visit has been completed, unless information is needed for a dispute, fraud prevention, accounting, or another continuing purpose.

…mailing lists

We retain active subscriber information while the person remains subscribed, or while we have another lawful basis for relevant marketing.

When someone opts out, we retain the minimum information needed on a suppression list for as long as reasonably necessary to honour the objection.

…creative work and published material

Unsuccessful or unsolicited material is normally retained for no more than two years after a decision or the last meaningful contact, unless otherwise agreed.

Material included in a publication, project archive, recording, or continuing professional relationship may be kept for as long as the publication, project, agreement, or associated rights remain relevant.

Printed publications already distributed and archived copies may remain in existence indefinitely.

…recordings

Meeting recordings are retained only for as long as needed for the agreed purpose, the associated service, or any relevant contractual or legal requirement.

…website and security information

Technical logs, cookies, analytics information, and anti-spam records are retained according to their purpose and the settings of the relevant service. Current cookie durations should be shown through our cookie preference tool.

…backups

Information may remain temporarily in secure backups after it has been removed from active systems. Backups are retained according to the relevant provider’s backup cycle and are normally overwritten in due course. Information held only in backups is not routinely used unless restoration is necessary.

We may retain information for longer where reasonably necessary to establish, exercise, or defend legal claims, comply with law, investigate fraud, or resolve a complaint.

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure.

These measures may include:

• access controls;
• password and account security;
• secure hosting;
• software updates;
• backups;
• encrypted connections where available;
• limiting information shared with contractors and service providers; and
• using established payment and cloud service providers.

No internet transmission, website, or storage system can be guaranteed to be completely secure. Please take care when sending information and do not include information that is not needed.

You may choose whether to provide most personal information.

However, some information is necessary for us to:

• respond to an enquiry;
• enter into or perform a contract;
• process and deliver an order;
• make a booking;
• administer a competition;
• pay a freelancer or supplier;
• meet legal or accounting obligations; or
• protect our website and services.

If the necessary information is not provided, we may be unable to complete the relevant transaction, booking, entry, or service.

Epic Tales does not make decisions producing legal or similarly significant effects about people solely through automated processing.

We may use automated tools for routine functions such as spam detection, payment checks, fraud screening, email delivery, and website security, but significant decisions are not made solely by those systems on our behalf.

Depending on the circumstances and our lawful basis for processing, you may have the right to:

• ask whether we hold personal information about you;
• receive a copy of your personal information;
• have inaccurate information corrected;
• have incomplete information completed;
• ask us to delete information;
• ask us to restrict how information is used;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• raise concerns about automated decision-making.

These rights are not all absolute. For example, we may need to retain information to comply with law, fulfil a contract, protect another person’s rights, or establish or defend a legal claim.

To exercise a right, contact privacy@epictales.co.uk. Please describe the information or activity concerned. We may ask for reasonable evidence of identity before disclosing or changing personal information.

We normally respond without charge. A reasonable fee may be charged, or a request may be refused, where the law permits this because a request is manifestly unfounded or excessive.

Withdrawing consent does not affect processing that took place lawfully before withdrawal.

Please contact privacy@epictales.co.uk first if you have a concern about how we use personal information. We will investigate and try to resolve the matter.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection. Information about making a complaint is available through the ICO website.

We may update this notice when our services, systems, providers, or legal obligations change.

The date at the top shows when the notice was last updated. Material changes may also be brought to people’s attention through our website or relevant communications.