Onwa Privacy Notice

 

Effective date: 30 July 2026
Version: 1.0

 

1. About this Privacy Notice

Onwa respects your privacy and is committed to protecting your personal information.

This Privacy Notice explains:

• what personal information Onwa collects;
• how and why it is used;
• the lawful bases relied upon;
• who the information may be shared with;
• how long it is retained;
• your data-protection rights; and
• how to contact Onwa about your information.

This Privacy Notice applies to people who visit the Onwa website, register as readers, submit or receive books, join book queues, make payments, communicate with Onwa or participate in the Onwa community.

 

2. Who is responsible for your information?

David Harper, trading as Onwa, is the controller responsible for your personal information.

Onwa is based in Oxfordshire, United Kingdom.

Privacy contact: David Harper
Email: Privacy@onwa.co.uk

References to “Onwa”, “we”, “us” or “our” in this Privacy Notice mean David Harper trading as Onwa.

 

3. Who can use Onwa?

Onwa is intended for readers aged 16 or over.

You must not independently register for or use Onwa’s circulation service if you are under 16.

A parent or guardian may allow a younger person to read an Onwa book through the adult’s own reader account. The adult remains responsible for the book, circulation fee, delivery arrangements and communications with Onwa.

We do not knowingly create independent reader records for anyone under 16. If we become aware that we have collected personal information from someone under 16 contrary to this policy, we will take appropriate steps to remove it.

​

4. Personal information we collect

The information collected depends on how you interact with Onwa.

 

Identity and contact information

This may include:

• your name;
• email address;
• telephone number;
• chosen display name;
• town, county or general location;
• WhatsApp name, telephone number and profile information; and
• other contact information you provide.

 

Reader and participation information

This may include:

• your reader registration details;
• confirmation that you are aged 16 or over;
• the date you joined;
• communication preferences;
• reading interests or preferences;
• books you have submitted, requested, received or circulated;
• book queue entries and positions;
• circulation status;
• records of dispatch and receipt; and
• your participation in the Onwa community.

 

Book-journey information

This may include:

• the relevant book and Book Passport identifier;
• sender and recipient records;
• journey number;
• dispatch, delivery and receipt dates;
• general journey locations;
• distance travelled;
• delivery or locker information;
• QR codes and postage references;
• whether the book was received and sent onward;
• problems or delays affecting the journey; and
• records needed to maintain the book’s circulation history.

 

Reader contributions

This may include:

• ratings;
• reviews;
• “One Word” contributions;
• physical Book Passport entries;
• comments, feedback or suggestions;
• photographs submitted to Onwa;
• testimonials; and
• community messages or contributions.

Onwa does not publish your personal contact information online.

Information that you voluntarily write in a physical Book Passport may be seen by future readers of that book. You should not write your full address, email address, telephone number or other sensitive information in a Book Passport.

 

Payment and transaction information

Onwa charges a £2.50 circulation fee for each book journey.

Payments are processed through Stripe. Payment-related information may include:

• your name and email address;
• the payment amount;
• the payment date and time;
• payment status;
• currency;
• Stripe transaction or payment reference;
• refund or payment-dispute information; and
• limited information about the payment method made available by Stripe.

Payment-card information is entered directly into Stripe’s payment service. Onwa does not intentionally store full payment-card numbers or security codes in Airtable.

Payments received through Stripe are transferred to Onwa’s business bank account. The bank will therefore hold records relating to payments and settlements under its own privacy arrangements.

 

Communications

This may include:

• emails sent to or from Onwa;
• website-form submissions;
• WhatsApp messages;
• support enquiries;
• book-circulation updates;
• complaints;
• data-protection requests;
• survey responses; and
• notes made while resolving an enquiry or operational issue.

 

Website and technical information

When you use the Onwa website, Wix and other authorised service providers may collect technical information such as:

• your IP address;
• browser type;
• device type;
• operating system;
• pages visited;
• dates and times of visits;
• the website that referred you to Onwa;
• cookie identifiers; and
• website-security and diagnostic information.

Further information about cookies will be provided in Onwa’s Cookie Notice.

 

Sensitive personal information

Onwa does not normally need to collect special-category or otherwise sensitive personal information.

Please do not provide information about your health, religion, ethnicity, political opinions, sexual life or other sensitive matters unless it is genuinely necessary and Onwa has asked you to provide it.

 

5. How we obtain personal information

Most personal information is collected directly from you when you:

• register with Onwa;
• submit a book;
• join a queue;
• pay a circulation fee;
• complete a circulation form;
• contact Onwa;
• use WhatsApp;
• subscribe to updates;
• complete a Book Passport; or
• use the Onwa website.

We may also receive limited information from:

• another reader involved in a book journey;
• Stripe;
• InPost or another delivery provider;
• Wix;
• Airtable;
• WhatsApp or Meta;
• our email provider;
• our business bank;
• website analytics and security services; or
• publicly available sources where relevant and lawful.

 

6. Why we use your information

We use personal information to:

• register and manage readers;
• assess book submissions;
• manage book queues;
• process circulation fees;
• arrange and administer book journeys;
• provide postage instructions and QR codes;
• confirm that books have been dispatched and received;
• contact readers about books in their possession;
• help readers send books onward;
• maintain book-journey records;
• resolve lost, delayed or damaged-book issues;
• provide customer support;
• respond to enquiries and complaints;
• protect readers, Onwa and its systems;
• prevent fraud, misuse and disruption;
• analyse and improve the circulation process;
• maintain financial, tax and accounting records;
• send operational communications;
• send newsletters and marketing where permitted;
• administer the optional WhatsApp community;
• establish, exercise or defend legal claims; and
• comply with legal and regulatory obligations.

 

7. Our lawful bases

UK data-protection law requires Onwa to have a valid lawful basis for each use of personal information.

The principal lawful bases used by Onwa are set out below.

 

Contract

We use information where it is necessary to provide the Onwa circulation service you have requested or to take steps at your request before providing that service.

This includes:

• registering and managing your reader account;
• managing book queues;
• processing circulation payments;
• coordinating book journeys;
• sending postage instructions and QR codes;
• confirming dispatch and receipt; and
• contacting you about an active book journey.

 

Legal obligation

We use or retain information where this is necessary to comply with a legal obligation.

This includes:

• maintaining tax and accounting records;
• responding to valid legal requests;
• handling data-protection rights; and
• managing formal data-protection complaints.

 

Legitimate interests

We use information where it is necessary for a legitimate operational or business interest and that interest is not overridden by your rights.

These interests include:

• maintaining a reliable book-circulation network;
• protecting books and readers;
• investigating missing books or misuse;
• maintaining system security;
• improving Onwa;
• keeping proportionate evidence of transactions and disputes; and
• preserving anonymised or pseudonymised book-journey history.

 

Consent

We rely on consent where an activity is genuinely optional.

This may include:

• receiving the Onwa Monthly Dispatch;
• receiving optional marketing communications;
• joining an optional WhatsApp group or community;
• allowing Onwa to publish a photograph or testimonial; and
• using non-essential analytics or marketing cookies.

You may withdraw consent at any time by contacting Privacy@onwa.co.uk.

Withdrawing consent does not affect any processing that took place before consent was withdrawn.

 

8. Operational and marketing communications

Operational communications

Operational communications are messages needed to provide or administer the Onwa service.

They may include:

• registration confirmations;
• queue confirmations;
• circulation-fee and payment messages;
• notification that a book is being sent;
• postage instructions and QR codes;
• dispatch and arrival confirmations;
• onward-circulation reminders;
• messages about lost or delayed books;
• service, security or privacy notices; and
• responses to enquiries.

These are not marketing messages.

While you are actively using Onwa, we may need to send these messages even if you have opted out of marketing.

Marketing communications

Marketing communications may include:

• the Onwa Monthly Dispatch;
• general announcements about new books;
• community stories;
• news about Onwa’s growth;
• information about new features or services;
• invitations, promotions or offers; and
• requests to participate in optional campaigns.

We will send electronic marketing where you have consented or where applicable electronic-marketing law otherwise permits it.

You may unsubscribe at any time by using the unsubscribe option in the message or by contacting Privacy@onwa.co.uk.

We may retain a minimal record after you unsubscribe to make sure you are not accidentally added back to marketing communications.

9. WhatsApp

Participation in Onwa’s WhatsApp groups or community is optional.

You may also choose to receive essential book-journey information through WhatsApp, including:

• notification that a book is being sent;
• postage instructions;
• QR codes;
• circulation reminders; and
• messages concerning an active journey.

Where you do not use WhatsApp, Onwa will provide essential operational information through another available communication method, normally email.

WhatsApp is operated by Meta. If you use WhatsApp:

• Meta will process information under its own privacy arrangements;
• your WhatsApp profile name, photograph and telephone number may be processed by Meta;
• certain profile information may be visible to other participants depending on the type of group and your settings; and
• other participants may be able to contact you directly.

You should review your WhatsApp privacy settings and avoid posting personal delivery information or other sensitive information in a group.

Onwa will ordinarily send individual postage details and QR codes through direct communication rather than placing them in a general group.

10. Physical Book Passports

Onwa books may contain a physical Book Passport that travels with the book.

A Book Passport may invite readers to add limited information such as:

• a first name or chosen reader name;
• general location;
• date;
• rating; and
• a short “One Word” contribution.

These entries may be seen by future readers who receive the physical book.

Completing these fields is voluntary.

You should not enter:

• your surname, unless you are comfortable doing so;
• your precise address;
• your email address;
• your telephone number;
• private delivery information; or
• sensitive personal information.

Onwa may retain an internal digital record of the book’s journey. Where possible, long-term journey history will be retained in anonymised or pseudonymised form.

11. Who we share information with

Onwa does not sell personal information.

We may share information with trusted providers where this is necessary to operate Onwa.

Wix

Wix hosts and supports the Onwa website and may process website, form, cookie, analytics and technical information.

Airtable

Airtable is used to manage Onwa’s operational records, including reader, book, queue and journey information.

Stripe

Stripe processes circulation-fee payments and associated payment information.

WhatsApp and Meta

WhatsApp is used as an optional community and communications channel.

InPost and other delivery providers

Delivery providers may process information required to arrange, administer or investigate a book delivery.

Email and communication providers

Our email provider processes messages sent to and from Onwa and may support operational and marketing communications.

Banking and financial providers

Our business bank receives Stripe settlements and maintains transaction records.

Professional and technical support

We may provide limited access to authorised developers, IT providers, accountants, insurers, legal advisers or other professional advisers where reasonably necessary.

Anyone acting on Onwa’s behalf must only use the information for the authorised purpose and must protect it appropriately.

Authorities and legal recipients

We may disclose information where required or permitted by law, including to:

• courts;
• regulators;
• law-enforcement bodies;
• tax authorities; or
• parties involved in establishing, exercising or defending legal claims.

Other readers

We do not provide readers with another reader’s email address, telephone number or home address merely because they are involved in the same book journey.

Limited Book Passport information may, however, be visible to future readers as explained above.

12. International transfers

Some of Onwa’s technology and service providers operate internationally. This means personal information may be stored in or accessed from countries outside the United Kingdom.

Where a restricted international transfer takes place, we require the transfer to be protected through an approved legal mechanism, such as:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• an approved UK addendum to standard contractual clauses; or
• another lawful safeguard.

You may contact Privacy@onwa.co.uk for further information about safeguards relevant to your personal information.

13. How long we retain information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.

Our normal retention periods are set out below.

Active reader records

Active reader registration and contact details are retained for the duration of your active participation in Onwa.

Inactive reader contact details are reviewed and will normally be deleted or anonymised after 24 months without activity.

Book-journey records

Identifiable information connected to a completed book journey will normally be retained for 24 months after the journey is completed.

Anonymised or pseudonymised book-journey history may be retained permanently.

Queue records

Active queue information is retained for the duration of the queue.

Completed, cancelled or withdrawn queue records will normally be retained for 12 months.

Delivery information

Delivery information, postage references and QR-code records will normally be retained for 12 months after successful completion or cancellation.

Payment and accounting records

Payment, tax and accounting records will normally be retained for six years after the end of the relevant tax year.

Book submissions

Unsuccessful or withdrawn book submissions will normally be retained for 12 months.

Enquiries and support correspondence

General enquiries and support correspondence will normally be retained for 12 months after resolution.

WhatsApp correspondence

Operational WhatsApp correspondence will normally be retained for 12 months after the relevant journey or issue has closed.

Marketing records

Marketing subscription and consent records will be retained while you remain subscribed and for a proportionate period afterward.

Marketing suppression records may be retained for as long as necessary to make sure your opt-out is respected.

Complaints and disputes

Data-protection complaints and significant disputes will normally be retained for up to six years after closure.

Website information

Website logs and cookie information are retained according to operational need, provider settings and the Onwa Cookie Notice.

We may retain information for longer where:

• the law requires it;
• a complaint, investigation or legal claim is ongoing;
• there is a continuing risk of fraud or misuse; or
• you have asked us to preserve information.

When identifiable information is no longer needed, it will be deleted, anonymised or separated from the permanent book-journey history.

14. How we protect information

Onwa uses proportionate technical and organisational measures intended to protect personal information against accidental loss, unauthorised access, misuse, alteration or disclosure.

These measures include, where appropriate:

• restricting access to people who need the information;
• using password-protected systems;
• using multi-factor authentication where available;
• controlling access to Wix, Airtable, Stripe and other services;
• minimising the information collected;
• reviewing supplier security arrangements;
• maintaining appropriate backups;
• keeping software and accounts secure;
• using confidentiality requirements for authorised contractors; and
• maintaining procedures for responding to security incidents.

No online service can guarantee absolute security.

If Onwa identifies a personal-data breach, it will investigate and make any required notifications.

15. Your rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

• ask whether we hold personal information about you;
• receive a copy of your personal information;
• correct inaccurate or incomplete information;
• request deletion of your information;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• receive certain information in a portable format;
• withdraw consent; and
• complain about how your information has been used.

These rights are not absolute.

For example, Onwa may need to retain certain payment records to comply with tax law or retain information needed to establish or defend a legal claim.

A request to delete your information will not necessarily require deletion of the non-identifying historical journey of a book. Where appropriate, we may remove the link between you and the journey while retaining anonymised journey information.

To exercise any of these rights, contact:

Privacy@onwa.co.uk

We may ask for proportionate information to confirm your identity.

We normally respond without undue delay and within one calendar month. Where a request is complex or you make several requests, the response period may be extended where the law permits.

16. Data-protection complaints

You may complain to Onwa if you are concerned about how your personal information has been collected, used, retained or shared.

Please email:

Privacy@onwa.co.uk

It will help us investigate if you include:

• your name and contact information;
• a description of your concern;
• relevant dates;
• details of the Onwa service or book journey involved; and
• copies of any relevant messages or documents.

We will acknowledge a data-protection complaint within 30 days.

We will take appropriate steps to investigate it, keep you informed where necessary and communicate the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s data-protection regulator.

We would appreciate the opportunity to address your concern directly first, but you are not required to contact Onwa before approaching the regulator.

17. Automated decision-making

Onwa does not currently use solely automated decision-making that produces legal or similarly significant effects for readers.

Onwa may use software to organise queues, calculate journey distances, send notifications or support administration.

Material decisions affecting a reader will involve human oversight where appropriate.

18. Links to other websites and services

The Onwa website may contain links to third-party websites or services.

Those organisations operate under their own privacy notices.

Onwa is not responsible for how an independent third party processes information after you leave the Onwa website or choose to use its service.

19. Changes to this Privacy Notice

We may update this Privacy Notice when:

• Onwa’s services change;
• new technology or providers are introduced;
• our data practices change; or
• legal or regulatory requirements change.

The latest version will be published on the Onwa website with its effective date.

Where a change materially affects how we use your information, we will take reasonable steps to bring it to your attention.

20. Contacting Onwa

Questions, requests and complaints concerning this Privacy Notice or your personal information should be sent to:

David Harper
Onwa Privacy Contact
Email: Privacy@onwa.co.uk