Privacy Policy

Last updated: 18 September 2026

Who we are

This website, allisonlocke.com, is run by Aspeya Aleksieva, who writes as Allison Locke (“we”, “us”). We are the controller of the personal data described in this policy.

We process personal data under the EU General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act. We are not required to appoint a data protection officer. Please send any privacy question to the email address above.

What we collect and why

Newsletter and the free bonus scene

When you sign up to receive Seven and a Half Feet and book news, we collect your email address. Our email provider, Kit, also records the date and time you signed up, your IP address and whether you open or click our emails.

We use this to send you the bonus scene and occasional news about Allison Locke’s books. Legal basis: your consent (Article 6(1)(a) GDPR). You can unsubscribe at any time with the link at the bottom of every email. Withdrawing consent does not affect emails we sent before.

Our sign-up forms send your email address to Kit only when you submit them, and they store nothing on your device. After you submit, Kit shows its own confirmation message, and Kit’s Privacy Policy applies to that page. After you confirm, the button in the confirmation email opens a private page where you can read and download the scene. That page sets no cookies of its own and does not ask you to log in.

Contact form and email

When you use the contact form (which runs on our own website) or email us, we collect your name, your email address, the subject and your message, plus anything else you choose to include.

We use this to reply to you and to handle press, review, rights and event requests. Legal basis: our legitimate interest in answering the messages we receive (Article 6(1)(f) GDPR). Where your request concerns a possible agreement, such as a rights or licensing deal, the legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).

Please do not send sensitive information, such as health data, through the form.

Spam protection for the contact form

Before a contact form message reaches us, ActiveLayer, an automated spam filter, checks it. ActiveLayer receives the content of the form, including your email address and related technical data, and returns a verdict on whether the message is spam. Legal basis: our legitimate interest in protecting the website from spam and abuse (Article 6(1)(f) GDPR). A message wrongly flagged as spam may not reach us. If you get no reply, please email us directly.

Visiting the website

When you visit, the servers of our hosting provider automatically log technical data: your IP address, your browser and device type, the page you requested, the page that referred you and the date and time. We use this to deliver the website, keep it secure and fix errors. Legal basis: our legitimate interest in running a secure, working website (Article 6(1)(f) GDPR).

We do not use advertising trackers. The fonts on this website are served from our own server, so your visit does not send data to Google Fonts. We do not sell personal data.

Visitor statistics (Google Analytics)

If you allow Statistics cookies, we use Google Analytics 4 to count visits and to see which pages people read and how they found the site. Google Analytics then receives the pages you view, the referring website, your device and browser type, your approximate location (which Google works out from your IP address) and a random ID stored in a cookie. Google Analytics 4 does not log or store IP addresses from EU visitors.

We use this to understand which pages work and to improve the website. We do not use it for advertising. Before a page address reaches Google Analytics, we remove any Kit subscriber ID from it. Google Analytics also records which buttons and links you click, with the button’s text and where it leads. For email links we record only that an email link was clicked, and for downloads only the file type. Legal basis: your consent (Article 6(1)(a) GDPR). Google Analytics does not load until you give consent, and you can withdraw consent at any time with the cookie settings button on every page.

Cookies and similar technologies

We use a small number of cookies and similar technologies. Our Cookie Policy lists each one, what it does and how long it lasts. You can change your cookie choices at any time with the cookie settings button on every page.

Links to other websites

Our pages link to other websites, such as Amazon, where you can pre-order the books, and Instagram. When you follow one of these links, that website’s own privacy policy applies. We do not share your personal data with these websites.

Who receives your data

We share personal data only with service providers that process it on our behalf and under our instructions:

  • Kit (kit.com), United States: newsletter sign-up forms, subscriber list and email delivery.
  • ActiveLayer (activelayer.com): spam filtering for the contact form.
  • Google Analytics (Google Ireland Limited, with Google LLC in the United States): visitor statistics, only if you consent.
  • Our web hosting provider: stores the website and its server logs, and sends the emails the website generates, such as contact form notifications.
  • Our email provider: receives and stores messages sent to our email address.

We may also disclose personal data where the law requires it, for example to a court or a public authority.

Transfers outside the European Economic Area

Some of these providers are based in, or store data in, the United States. For providers certified under the EU-U.S. Data Privacy Framework, such as Kit and Google, we rely on the European Commission’s adequacy decision for that framework. For other providers, we rely on the European Commission’s Standard Contractual Clauses. You can ask us for more information about these safeguards at press@allisonlocke.com.

How long we keep your data

  • Newsletter: until you unsubscribe. After that, we keep your email address only on a suppression list so that we do not email you again.
  • Contact messages: up to two years after our last exchange. If a message concerns an agreement, we keep it for as long as the agreement and the related legal limitation periods require.
  • Spam checks: as set out by ActiveLayer, and no longer than needed to filter spam.
  • Server logs: only as long as needed for security and troubleshooting, in line with our hosting provider’s standard log rotation.
  • Google Analytics: no longer than 14 months, then Google deletes it automatically.
  • Cookies: as listed in our Cookie Policy.

Your rights

Under the GDPR, you have the right to:

  • access the personal data we hold about you and receive a copy of it;
  • have inaccurate personal data corrected;
  • have your personal data erased;
  • restrict how we use your personal data;
  • receive your personal data in a portable format, where we process it based on your consent or a contract;
  • object at any time to processing based on our legitimate interests;
  • withdraw your consent at any time, without affecting processing that took place before.

To use any of these rights, email press@allisonlocke.com. We will reply within one month. We may ask you to confirm your identity before we act on a request.

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significant effects for you.

How to complain

If you think we have mishandled your personal data, please contact us first so we can put it right. You also have the right to lodge a complaint with a supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (Комисия за защита на личните данни), www.cpdp.bg. You can also complain to the data protection authority in the EU country where you live or work.

Children

This website is intended for adult readers. We do not knowingly collect personal data from children under 16. If you believe a child has sent us personal data, please contact us and we will delete it.

Changes to this policy

We update this policy when our practices change. The date at the top of the page shows when it was last updated.