Privacy Policy

Last updated: 29 August 2026

This Privacy Policy explains how personal information is collected,
used and protected when you visit
https://kelliekennedy.com,
subscribe to the newsletter, submit a contact form, leave a comment
or otherwise interact with the website.

The website is operated by Victoria Kennedy, writing as Kellie
Kennedy. For the purposes of UK data protection law, Victoria
Kennedy is the data controller responsible for the personal
information described in this policy.

1. How to contact us

If you have a question about this Privacy Policy or would like to
exercise your data protection rights, please contact:

Data controller: Victoria Kennedy, writing as
Kellie Kennedy
Website:
https://kelliekennedy.com
Email:
kellie+privacy@kelliekennedy.com

Nicholas Kennedy assists Victoria with the day-to-day
administration of the website and may access personal information
where necessary to operate, maintain and secure the website.
Victoria remains responsible for deciding how and why personal
information is used.

2. Personal information we collect

The personal information collected depends on how you use the
website.

Information you provide

We may collect information that you provide when you:

• Subscribe to the newsletter, including your first name, last
  name, email address, consent selection and subscription date.
• Submit the contact form, including your name, email address,
  subject and message.
• Contact us directly by email.
• Leave a comment on a blog post, if commenting is enabled,
  including your name, email address, comment and associated
  technical information.
• Exercise a privacy right or make a complaint.

Information collected automatically

When you visit the website, certain technical information may be
collected automatically. This can include:

• Your Internet Protocol address.
• Browser type and version.
• Device type and operating system.
• Pages visited and the time and date of a visit.
• The website or link that referred you to this website.
• Cookie choices and consent records.
• Security, diagnostic and server-log information.

Non-essential analytics and similar technologies will only be used
after the appropriate cookie permission has been obtained where
consent is required.

3. How and why we use personal information

4. Newsletter subscriptions

The newsletter is managed using FluentCRM and related WordPress
tools. Newsletter information is stored within the website’s
WordPress system.

The newsletter uses double opt-in. After submitting the
subscription form, you will be asked to confirm your email address
before receiving newsletters.

Newsletter emails may contain tracking pixels and tagged links
that record whether an email was opened and whether a link was
selected. This information is used to understand newsletter
engagement and improve future messages.

You can withdraw your consent and unsubscribe at any time by using
the unsubscribe link in a newsletter or by contacting
kellie+privacy@kelliekennedy.com.
Withdrawing consent does not affect processing that took place
before the withdrawal.

5. Contact forms and email

Contact forms are provided using Fluent Forms. When you submit a
contact form, the information may be stored within WordPress and
sent to a Google Workspace email account.

Please avoid including sensitive personal information in a
contact-form message unless it is genuinely necessary.

6. Cookies and similar technologies

The website uses cookies and similar technologies to operate
correctly, remember visitor choices, understand website usage and,
where enabled, display third-party content.

Strictly necessary cookies may be used without consent where they
are required to provide a service, maintain security or remember
your cookie choices. Analytics, embedded-media and other
non-essential technologies will only be enabled after consent
where required.

Cookie preferences are managed using WPLP Cookie Consent. You can
accept, reject or choose categories of non-essential cookies using
the cookie banner. You can subsequently change or withdraw your
choices using the website’s Cookie Settings control.

More information about individual cookies and their purposes is
available in the
Cookie Policy.

7. Analytics and search services

Google Analytics

Subject to your cookie choices, the website may use Google
Analytics to understand how visitors find and use the website.
Google Analytics may process information such as pages visited,
approximate location, device information, browser information and
interactions with the website.

Google Analytics will only be activated after analytics consent
has been provided where consent is required. Google Analytics
user-level and event information should be configured to be kept
for no longer than 14 months unless a shorter period is selected.

Google Search Console

Google Search Console is used to understand how the website
appears in Google search results, identify technical issues and
review aggregated search-performance information. Search Console
does not provide us with the identity of individual search users.

Information about Google’s handling of personal information is
available in

Google’s Privacy Policy
.

8. Fonts and external resources

The website may obtain fonts from Google Fonts. Where fonts are
loaded directly from Google, the visitor’s browser connects to
Google’s servers and may disclose technical information such as an
IP address, browser information and the requested font file.

Where practical, fonts may instead be hosted locally on the
website to reduce data sharing with third parties.

9. Spam prevention and website security

The website may use an automated spam-prevention service to
protect forms and comments from fraudulent or abusive
submissions. Depending on the service selected, this may involve
processing an IP address, browser information, interaction data
and information entered into a form.

This Privacy Policy and the Cookie Policy will be updated to
identify the selected spam-prevention provider before or when that
provider is activated.

10. Embedded media and social-media content

The website may include embedded content from services such as
YouTube, Facebook and Instagram. Embedded content can behave in
the same way as if you visited the third-party website directly.

These providers may collect technical information, use cookies or
similar technologies and record interactions with embedded
content. Where required, embedded content and associated
non-essential technologies will remain blocked until you provide
consent.

The relevant services operate under their own privacy terms:

• 
  Google and YouTube Privacy Policy
  
• 
  Meta Privacy Policy for Facebook and Instagram
  

11. Retailer and affiliate links

The website contains links to third-party book retailers,
including services such as Amazon, Kobo, Barnes & Noble and
Google Play. Purchases are completed on the retailer’s website,
not on this website.

Some retailer links are affiliate links. This means Victoria may
receive a commission if you follow a link and make a qualifying
purchase, without increasing the price you pay.

When you select an external retailer or affiliate link, the
retailer may collect information, use cookies and record that the
visit originated from an affiliate link. The retailer is
responsible for its own use of personal information. You should
review the retailer’s privacy and cookie information before
completing a purchase.

We may receive aggregated affiliate reports, such as the number of
qualifying purchases and commissions earned. We do not normally
receive the purchaser’s payment-card information from the
retailer.

12. Blog comments

If comments are enabled, information submitted with a comment may
be stored and displayed with the relevant blog post. An email
address submitted with a comment will not normally be displayed
publicly.

Comments may be moderated, refused or removed where reasonably
necessary to prevent spam, abuse, unlawful content or disruption.
Please do not include information in a public comment that you do
not want other people to see.

13. Who receives personal information

Personal information is only disclosed where reasonably necessary
to operate the website, communicate with visitors, comply with the
law or protect legitimate interests.

Recipients and service-provider categories may include:

• Victoria Kennedy as the data controller.
• Nicholas Kennedy as an authorised website administrator.
• Cloudways and its infrastructure providers for website
  hosting, backups, security and technical support.
• Fluent Forms and FluentCRM, which operate within WordPress to
  manage forms and newsletter subscriptions.
• Google Workspace for receiving and storing email.
• Google for Analytics, Search Console, fonts and YouTube
  content, where those services are used.
• Meta for Facebook and Instagram content, where those services
  are used.
• A spam-prevention or website-security provider once selected.
• Professional advisers, insurers, regulators, public
  authorities or law-enforcement bodies where disclosure is
  reasonably necessary or legally required.

Personal information is not sold to data brokers or advertisers.

14. International data transfers

Some service providers may process personal information outside
the United Kingdom. This may include processing in the European
Economic Area, the United States or other countries in which a
provider operates.

Where UK data protection law requires safeguards for an
international transfer, we will rely on an applicable UK adequacy
regulation or appropriate contractual safeguards, such as the UK
International Data Transfer Agreement, the UK Addendum to approved
standard contractual clauses, or another legally recognised
transfer mechanism.

The website’s hosting infrastructure may change. Hosting and
transfer information will be reviewed when the website moves to a
new server.

15. How long information is retained

We use the following general retention periods:

• Contact messages: normally for two years
  after the last correspondence.
• Active newsletter records: while you remain
  subscribed, subject to periodic review of inactive records.
• Unsubscribe records: the minimum information
  necessary may be retained on a suppression list so that your
  request not to receive marketing is respected.
• Blog comments: while the associated post and
  comment remain published, subject to moderation, removal
  requests and periodic review.
• Cookie-consent records: normally for two
  years from the relevant consent decision, unless a longer
  period is reasonably required to establish compliance.
• Google Analytics information: user-level and
  event information should be configured for a maximum of 14
  months unless a shorter retention period is selected.
• Technical and security records: only for as
  long as reasonably necessary to maintain security,
  investigate an incident, meet a legal requirement or resolve
  a dispute.

Information may be retained for longer where necessary to comply
with a legal obligation, resolve a dispute or establish, exercise
or defend a legal claim. Information that is no longer needed
will be deleted, anonymised or placed beyond ordinary use during
the normal backup-rotation process.

16. How personal information is protected

Reasonable technical and organisational measures are used to
protect personal information against accidental loss,
unauthorised access, misuse, alteration or disclosure. These
measures may include access controls, password protection,
software updates, encrypted connections, backups and limiting
administrative access to people who need it.

No internet transmission or storage system can be guaranteed to
be completely secure. If you believe personal information
associated with the website has been compromised, please contact
us promptly.

17. Your data protection rights

Depending on the circumstances and the lawful basis being used,
UK data protection law may give you the right to:

• Request access to your personal information.
• Ask for inaccurate or incomplete information to be corrected.
• Ask for personal information to be deleted.
• Ask for processing to be restricted.
• Object to certain uses of your personal information.
• Receive certain information in a portable,
  machine-readable format.
• Withdraw consent at any time where processing relies on
  consent.
• Complain to the Information Commissioner’s Office.

Some rights are not absolute and may depend on the circumstances.
We may need to request enough information to confirm your identity
before fulfilling a request. We will not ordinarily charge a fee
for exercising a data protection right.

18. Complaints

Please contact us first if you have concerns about how your
personal information has been handled. We will try to resolve the
issue.

You also have the right to complain to the UK Information
Commissioner’s Office:

Information Commissioner’s Office
Website:

https://ico.org.uk/

Telephone: 0303 123 1113

19. Children’s privacy

The website promotes general romance books, some of which may
contain adult themes. The website itself is not specifically
directed at children under 13, and we do not knowingly collect
personal information from children under 13.

If you believe a child has provided personal information through
the website without appropriate authorisation, please contact us
so that the circumstances can be reviewed and the information
deleted where appropriate.

20. External websites

The website contains links to websites operated by retailers,
social-media platforms and other third parties. This Privacy
Policy does not control how those organisations collect or use
personal information. You should review the privacy information
provided by the relevant third party.

21. Changes to this Privacy Policy

This Privacy Policy may be updated when the website, its service
providers or applicable legal requirements change. The updated
version will be published on this page with a revised “Last
updated” date.

Material changes may also be brought to visitors’ attention
through the website or newsletter where appropriate.