How Kensington Square Therapy Ltd handles personal data
Privacy Policy.
Effective 31 May 2026 · v3.5 (Parent Book subscription tier added; school staff added in v3.1; on 25 September 2026, a second adult and gift links added, where Cloudflare stores records corrected, and the half-term note to school staff made something they ask for; on 26 September 2026, the monthly letter for parents who ask for it added; in v3.5, on 28 September 2026, what happens when you follow a link to Bookshop.org)
v3.0 supersedes v2.0 (February 2026) and folds in the additions required for the individual subscriber tier at theparentbook.com/parents. Statutory references appear in italics throughout.
1. Who the data controller is
| Legal name | Kensington Square Therapy Ltd (KST) |
| Company number | 16707111 (England and Wales) |
| Registered office (statutory) | Flat 408, 2 Macfarlane Place, London W12 7RS |
| Trading address (correspondence) | 23 Kensington Square, London W8 5HN |
| ICO Registration | ZC022097 |
| Data Protection Lead | Sam McManus, Sole Director |
| Subscriber-tier customer contact | hello@theparentbook.com |
| Clinical and corporate contact | contact@kst.ltd |
KST is the data controller for all the personal data described in this policy. We do not have a Data Protection Officer; the person responsible for data protection is the company’s sole director.
2. What this policy covers
This policy covers personal data processed in connection with: (a) visits to theparentbook.com and kst.ltd; (b) the "introduce your school" form on theparentbook.com; (c) the individual Parent Book subscription at theparentbook.com/parents (added in v3.0); (d) the teachers’ shelf at theparentbook.com/staff, used by members of school staff (added in v3.1); (e) the monthly letter at theparentbook.com/letter, for parents who ask for it (added in v3.4); and (f) the clinical services and school-based provision offered by KST (covered in the existing structure carried over from v2.0).
3. Data subject categories
3.1 Website visitors and enquirers (existing)
If you visit our sites we use Cloudflare Web Analytics, which is cookieless and does not set tracking identifiers. We see aggregate page-view counts and country-level geolocation. We do not see individual visitor IPs in any usable form. If you write to us from the schools page or the introduce-your-school page, we keep your name and email, the school’s name and website, your role if you give it, and any contact at the school you name. We use it to reply to you and, where a parent asks us to, to write once to that contact.
3.2 Individual subscribers (new in v3.0)
Where you take out an individual subscription to The Parent Book at theparentbook.com/parents, KST collects:
- Your subscriber email address. The account is keyed to this address. It is used to sign you in (via magic link), to email you about renewals, and to reach you about anything to do with the subscription.
- Your name, if you choose to give it. Name is optional. If you do not give us a name, we will address you by the first part of your email address in renewal reminders.
- Payment identifiers. Your bank details are held by GoCardless Ltd, our payment processor, under the rules of the UK Direct Debit Scheme. KST does not see or store your bank details. KST stores only the GoCardless identifiers that link your account to your subscription: the customer, mandate and subscription, and each payment and refund, with its date.
- Reading activity. Which chapters and resources you have opened, and when. This is used by KST for internal product analytics only (understanding which chapters land, which signposting resources are used, which older pieces are still earning their keep). It is not used for advertising, not used to build a profile of you for sale, and not shared with any third-party analytics service.
- Operational metadata. Magic-link request timestamps, sign-in timestamps, device user-agent strings (for session security and abuse detection), and IP address (kept in server logs for 30 days then rotated). No precise location tracking.
- Consent records. The state and timestamp of (a) your acceptance of the Terms and this Privacy Policy at checkout, with any box you ticked there (a subscription begun before 25 September 2026 also records the immediate-access box the checkout then carried), and (b) your marketing-email opt-in if you have given one. These records are kept to evidence the lawful basis for processing under Article 7(1) UK GDPR.
- Family personalisation details, if you choose to give them. To have the library lead with what fits your family, you can tell us each child’s age or year group and their school. This is optional, the library works without it, and you can change or delete it at any time from your account page. We store only the age or year group and the school, never the child’s name and nothing clinical. We use it only to default your library view to the pieces most relevant to your family and to time the school-year letters. It is held on your own subscriber record, and it is never shared.
- A second adult, if you add one. If your child lives between two homes, you can add the parent or carer in the other home so that they can sign in with their own address. We keep their email address, and a first name if you give one, on your subscriber record, and we keep their saved pieces and their place in each chapter separately from yours. We do not email them unless they ask for a sign-in link. You or they can remove them at any time from the account page, and what they saved is deleted when you do.
- Gift links you make. For each: which chapter, when, how many times the page was opened, and the first name shown on it. We keep this to count the ten a month, and so that a link you have sent keeps working.
Someone who opens a gift link does not create an account and is not asked for anything. KST holds no information about them unless they separately choose to subscribe.
What KST does not collect about subscribers. KST does not collect or process special category data about subscribers in connection with the subscription. KST does not intentionally collect any personal data about a subscriber’s child or other family member through the subscription, beyond the optional family personalisation details described above (a child’s age or year group and school, never a name and nothing clinical), which you provide and can remove at any time. If you choose to write to hello@theparentbook.com about your situation and share information about your family, KST treats that correspondence under section 7 (Sub-processors and sharing) and the email correspondence retention rules.
3.3 Children’s data
The individual subscriber tier is a service for adult parents and carers. Where you choose to personalise your library, KST stores a child’s age or year group and their school on your account, with your consent, to shape which chapters lead and to time the school-year letters. KST does not collect the child’s name, does not link reading activity to any individual child, holds no clinical or special category data about a child, and does not profile any child. The signposting library is a directory of organisations available to subscribers and their families. The Children’s Code (Age Appropriate Design Code) is engaged for KST’s clinical services to children but is not engaged for the subscriber tier, which has no child user and holds no identifying child data.
3.4 School staff using the teachers’ shelf (new in v3.1)
The teachers’ shelf at theparentbook.com/staff is a free tool for members of school staff. It is not a subscription, nothing is charged to the member of staff or to the school, and no contract is required to use it. Where a member of school staff opens an account, KST collects:
- Their school email address. The account is keyed to this address, which is also how KST can see that the account belongs to a school. Sign-in is by emailed single-use link rather than a password.
- Their name and their school’s name, if they choose to give them. Both are optional. The school’s name appears to parents on the pages they are sent; the member of staff’s own name is never shown to a parent.
- The links they have made. For each one: which piece from the library was sent, when, how many times the page was opened, and, where the member of staff chose to add them, a parent’s first name and a short line of their own. KST keeps this so a member of staff can send the same link again, and so KST can see that a school is using the shelf.
- Operational metadata. Sign-in timestamps and magic-link request timestamps, and IP address in server logs for 30 days as described above.
What KST does not collect about school staff. KST does not record which pages a member of staff reads or browses on the shelf, and does not build a profile of any member of staff as a reader. KST holds no pupil record, no roll, no upload from a school’s management information system, and no field anywhere in the shelf asks for a child’s name or anything about a child. The field in which a member of staff may write a line to a parent carries a plain instruction to write nothing about the child, and states that the resulting page has a public web address.
Parents who receive a page. A parent who opens a page sent from the shelf does not create an account and is not asked for anything. Where a member of staff has added a parent’s first name, that first name appears on the page and is held on the link record described above; KST holds no other information about that parent, and no email address for them, unless they separately choose to subscribe.
The rights in section 10 apply to members of school staff in the same way as to subscribers, and are exercised the same way, by emailing hello@theparentbook.com. A member of staff receives the half-term notes only after asking for them on the shelf, can stop them at any time from the one-click link on every one of them or from the shelf, and can ask for their account and its records to be deleted at once rather than waiting for the retention period below.
3.5 Parents who ask for the letter (new in v3.4)
The letter is a short email from KST, about once a month, on what tends to be on parents’ minds at that point in the year and what is new in the library. It is sent only to people who have asked for it at theparentbook.com/letter or on a chapter page, and then confirmed it from the email we send to check the address is theirs. No letter is sent to an address that has not been confirmed. For each person on the list KST keeps:
- The email address. Used only to send the letter.
- A record of the consent. When the letter was asked for and on which kind of page (a chapter, the letter’s own page), when it was confirmed, and which version of the words on the form was agreed to.
The letter carries no tracking pixels and KST does not record who opens it or what they press in it. The address is not shared, is not used for anything else, and is not joined to a subscription or to anything else KST holds. Every letter carries a link to leave; leaving takes one press, and the address is deleted at once. What is kept after someone leaves is the record that they agreed, and when, under a one-way code made from the address rather than the address itself. A request that is never confirmed is deleted after seven days. Anyone can leave, or ask what KST holds, by writing to hello@theparentbook.com.
4. Lawful bases for processing
| Processing activity | Lawful basis (Art. 6) |
|---|---|
| Delivering the individual subscription (access provision, magic-link sign-in, renewal reminders) | Contract (Art. 6(1)(b)) |
| Taking subscription payments and reconciling against accounts | Contract (Art. 6(1)(b)) and Legal obligation (Art. 6(1)(c)) for HMRC and Companies Act 2006 record-keeping |
| Subscriber product analytics (reading activity, in-house only) | Legitimate interests (Art. 6(1)(f)), balanced through (i) in-house processing only, (ii) no third-party analytics, (iii) no profiling for advertising, (iv) 12-month anonymisation. Subscribers can object via hello@theparentbook.com. |
| Operational security and abuse detection (sign-in metadata, IP logs) | Legitimate interests (Art. 6(1)(f)). Balanced through short retention (30 days for IP logs) and minimum-necessary processing. |
| Service-related transactional emails (renewal reminders, magic-link emails, account notices) | Contract (Art. 6(1)(b)). Not marketing communications. PECR consent rules for marketing email do not apply because these are service emails. |
| Updates to subscribers about what has been added to the library, and the seasonal letters | Legitimate interests (Art. 6(1)(f)): telling our own subscribers about the service they pay for, sent under the soft opt-in for a provider’s own similar products (PECR 2003 reg 22(3)). Subscribers are told at signup that these will be sent and how to stop them; every message carries a one-click unsubscribe and the setting is switchable on the account page. Withdrawing has no effect on the subscription. |
| Holding a second adult’s email address and first name so that they can sign in, and keeping their saved pieces and reading place | Legitimate interests (Art. 6(1)(f)): giving the adult in a child’s other home the access the subscriber has asked us to give them. Balanced through: the address is used only to sign them in; we never email them unless they ask for a sign-in link; the subscriber or the second adult can remove it at any time, and what they saved is deleted with it. |
| Gift links (which chapter, when, how often the page was opened, the sender’s first name) | Contract (Art. 6(1)(b)): part of the subscription the subscriber has taken out. |
| Storing optional family personalisation details (a child’s age or year group and school) to tailor the library and time the school-year letters | Consent (Art. 6(1)(a)). Given by ticking the personalisation consent box on the account page, and editable or deletable there at any time. Withdrawal is effective immediately and does not affect your subscription. |
| Running the teachers’ shelf for school staff (account, sign-in, and the record of links made so they can be sent again) | Legitimate interests (Art. 6(1)(f)): providing a free professional tool to a member of school staff who has asked for it, and keeping the minimum record that makes it work. Balanced through: a school address only; no record of what a member of staff reads; no profiling; the member of staff’s own name never shown to a parent; and deletion on request or after the dormancy period in section 9. |
| Sending the monthly letter to people who have asked for it and confirmed their address (section 3.5), and keeping the record that they did | Consent (Art. 6(1)(a)), and the consent PECR 2003 regulation 22 requires for marketing email to someone who is not a customer. Given by asking for the letter and pressing the confirmation button in the email that follows; withdrawn at any time by the link to leave in every letter. The record of the consent is kept under Article 7(1). |
| Telling school staff who have asked for it what has been added to the library, at the start of each half-term | Consent (Art. 6(1)(a)), given by pressing the button that asks for the note, on the shelf or on the page that stops it. Nothing is sent to a member of staff who has not asked. Every message carries a one-click stop, the same button on the shelf stops it, and stopping it has no effect on the account. |
5. Storage and security
School staff accounts and the records of the links they have made are stored in the same Cloudflare KV namespaces, in the same region, under the same access restrictions and the same encryption at rest and in transit as everything described in this section.
Subscriber records (email, name where given, GoCardless identifiers, reading activity, account state) are stored in Cloudflare Workers KV. KV is a global store: Cloudflare may hold or cache records in its data centres outside the UK and the EU, and we have not restricted it to one region. Those transfers are covered by the safeguards in sections 7 and 8. Access is restricted to the Director and to deployment automation; no other subcontractor has access. Subscriber data in Cloudflare KV is encrypted at rest and in transit. Subscriber correspondence and accounting records continue to sit in Google Workspace and Xero respectively, in line with the existing arrangements carried over from v2.0. The subscriber tier does not store personal data on local devices or unencrypted removable media.
6. Cookies on the subscriber tier
The /parents pages use one first-party cookie only:
| Cookie | Purpose and properties |
|---|---|
tpb_sess | Keeps you signed in after you click a magic link. First-party, strictly necessary. HttpOnly; Secure; SameSite=Lax; expires 90 days from last sign-in. Lawful basis: PECR 2003 reg 6(4)(b) "strictly necessary" exemption from consent. |
No analytics cookies, advertising cookies, or third-party trackers are set on the subscriber tier. The subscriber tier does not embed third-party scripts, pixels, tags or beacons. The cookie banner on the rest of the KST site does not apply because no consent-required cookies are set on the /parents pages.
Links to Bookshop.org (new in v3.5). On the book shelves, each Buy link to Bookshop.org goes through Awin, the network that runs Bookshop.org’s affiliate programme, and says so where it sits. If you follow one, Awin records that you came from The Parent Book, so that Bookshop.org can pay us a small commission on what you buy, and Awin and Bookshop.org set their own cookies on their own sites, under their own privacy policies. Nothing is set on ours, and we are not told who you are. A book named in a chapter is a plain link to Bookshop.org, not an affiliate link.
7. Sub-processors and sharing
KST uses the following sub-processors to operate the individual subscriber tier and certain related services. Each acts as a "processor" under UK GDPR, processes personal data only on KST’s documented instructions, and is bound by a written data processing agreement consistent with Article 28 UK GDPR.
| Sub-processor | Purpose, data, location and transfer mechanism |
|---|---|
| GoCardless Ltd (UK, FCA FRN 597190) | Purpose: direct debit mandate setup, recurring payment collection, payment reconciliation. Data: subscriber name (optional), subscriber email, bank account details, GoCardless customer/mandate/subscription IDs. Location: UK. Transfer: UK-based controller, no international transfer engaged. |
| Cloudflare, Inc. | Purpose: site hosting, edge delivery, KV storage for subscriber records, DDoS and bot mitigation. Data: subscriber email, account state, reading activity, IP address (transient, in edge logs). Location: Cloudflare’s global network, for KV storage and for delivery; KV storage is not restricted to one region. Transfer: UK IDTA and EU SCCs in place for any onward transfer outside the UK or EU; Cloudflare is a UK GDPR Article 28 processor under its Customer DPA. |
| Resend Inc. | Purpose: transactional email delivery (magic-link sign-in emails, renewal reminders, welcome and receipt emails, payment-failure notices, account notices). Data: subscriber email, content of transactional emails. Location: Resend EU region (eu-west-1, Ireland). Transfer: Resend operates EU-hosted infrastructure for theparentbook.com; UK IDTA in place via Resend’s standard DPA where any onward transfer applies. |
| Google LLC (carried from v2.0) | Purpose: Google Workspace for administrative and financial records, including subscriber correspondence and accounting records. Data: subscriber email, correspondence, invoice records. Location: US (Google Workspace with EU/UK data residency configured where supported). Transfer: UK IDTA and Google Workspace UK Addendum. |
| Xero (carried from v2.0) | Purpose: accounting records for subscription income. Data: subscriber email, invoice metadata, payment amounts. Location: UK, EU and Australia. Transfer: UK IDTA and EU SCCs as per Xero DPA. |
KST does not use the following classes of sub-processor for the subscriber tier: third-party advertising networks; third-party analytics platforms (such as Google Analytics, Mixpanel, Amplitude or similar); customer data platforms; marketing automation platforms (other than as covered by the optional marketing-email opt-in, which uses Resend only). KST will not add a new sub-processor with access to subscriber personal data without first updating this list and giving subscribers at least 30 days' notice. Sub-processor changes that are functional substitutions (for example, a hosting region change with the same Article 28 protections) may be made with shorter notice; KST will explain the reason and the data-protection assessment in the notice.
Awin is not a sub-processor. A Buy link to Bookshop.org (section 6) sends Awin nothing from us: if you follow one, your browser goes to Awin, and Awin and Bookshop.org handle what follows under their own privacy policies.
The letter uses the same sub-processors and no others: Cloudflare to store the list, and Resend to send the confirming email and the letters. Neither may use the addresses for any purpose of its own.
The teachers’ shelf uses the same sub-processors and no others: Cloudflare for hosting and for the KV storage that holds staff accounts and link records, and Resend for the sign-in emails and the half-term notes. GoCardless and Xero are not engaged by the shelf, because nothing on it is charged for. No school data, of any kind, is shared with any other party.
KST does not sell, rent or trade subscriber personal data. KST does not share subscriber personal data for marketing purposes. KST does not sell, rent, trade or share the personal data of school staff, and does not share it with any other school.
8. International transfers
For the individual subscriber tier, the principal international-transfer considerations are Google Workspace (US), Xero (UK, EU and Australia) and Cloudflare, whose KV storage is global rather than held in one region. KST relies on the UK International Data Transfer Agreement (IDTA) for these transfers, supplemented by each provider’s standard data processing agreement. Resend is EU-hosted (eu-west-1) and does not engage an onward international transfer for the subscriber tier in routine operation.
9. Retention
| Record type | Retention period and legal basis |
|---|---|
| Subscriber account records (email, name, GoCardless IDs, subscription status) | While the account is active, and for 6 years after the final payment date. Basis: Companies Act 2006 record-keeping; HMRC accounting and tax requirements; Limitation Act 1980 contractual claim window. |
| Subscriber reading activity (in identifiable form) | 12 months, then anonymised. Anonymised aggregates may be retained indefinitely as non-personal data. Basis: legitimate interests with retention limited to the period necessary for product analytics. |
| Subscriber transactional email logs (magic-link send, renewal reminders) | 12 months, then deleted. Basis: legitimate interests (operational audit trail). |
| Subscriber IP address logs (edge and sign-in) | 30 days, then rotated. Basis: legitimate interests (security and abuse detection). |
| Subscriber correspondence at hello@theparentbook.com | Up to 3 years from resolution of the enquiry, or longer if the matter is a complaint or DSAR. Basis: legitimate interests; complaints retention; DSAR accountability. |
| Consent records (acceptance at checkout, marketing opt-in state and timestamp) | Kept for as long as the consent is being relied upon, and for 6 years after withdrawal or end of subscription. Basis: Article 7(1) UK GDPR accountability; Limitation Act 1980. |
| Optional family personalisation details (child’s age or year group, school) | Kept while stored on your account. Deleted when you remove them, and in any event when your subscription ends. Basis: consent (Art. 6(1)(a)); minimum-necessary. |
| Messages from the schools and introduce-your-school forms | 2 years from submission, then deleted. |
| Webhook event records | 7 days (deduplication only), then deleted. |
| School staff accounts on the teachers’ shelf (address, name and school where given, sign-in times) | While the account is in use, and deleted automatically after 24 months with no sign-in. Deleted sooner on request. Basis: legitimate interests, with retention limited to the period over which a member of staff plausibly returns to a tool used at the start of a term. |
| Records of links made from the shelf (the piece sent, the date, the number of times opened, and any parent first name and line written by the member of staff) | Deleted with the account under the same 24-month rule, and on request at any time. A single link can be withdrawn at once, which stops the page working, on request from the member of staff or the school. |
| The letter: the address of someone on the list | While they are on the list. Deleted at once when they leave. A request that is never confirmed is deleted after 7 days. Basis: consent (Art. 6(1)(a)). |
| The letter: the record that someone agreed (when, where and to which words, and when they left), kept under a one-way code made from the address rather than the address itself | Kept for 6 years after they leave, as for the other consent records above. Basis: Article 7(1) UK GDPR accountability; Limitation Act 1980. |
| Shelf email logs (sign-in links, half-term notes) | 12 months, then deleted. Basis: legitimate interests (operational audit trail). |
10. Your rights as an individual subscriber
Under UK GDPR you have the rights set out below. To exercise any of them, email hello@theparentbook.com from your subscriber email address. KST will respond within one calendar month (per Article 12(3) UK GDPR).
- Subject Access. Ask for a copy of the personal data we hold about you.
- Rectification. Ask us to correct any incorrect data.
- Erasure. On request, KST will erase the personal data held about you for the subscriber tier. KST is required by the Companies Act 2006 and HMRC rules to retain a limited record of the financial transaction (date, amount, payee identifier) for 6 years from your final payment. KST will explain what has been retained and why if you ask.
- Portability. KST can supply your subscriber record (account metadata and reading activity) in a structured, common format on request.
- Objection to product analytics. You may object to reading-activity processing under Article 21 UK GDPR. KST will stop linking reading activity to your account within 14 days of your objection and anonymise the historical record for your account within 30 days, retaining only aggregated and unidentifiable counts.
- Withdrawing marketing consent. If you have opted in to marketing emails, you can withdraw consent at any time using the one-click unsubscribe link in any marketing email, or the toggle on your account page at theparentbook.com/parents/me. Withdrawal takes effect immediately and has no effect on your subscription.
- Restriction of processing. In specific circumstances, ask us to restrict processing.
- Complaint to the ICO. See section 11.
11. Complaints and the ICO
If you wish to complain about how KST has handled your personal data, please follow the Parent Book complaints procedure set out in the Terms of Subscription (section 16): email hello@theparentbook.com with the heading "Complaint". KST will acknowledge within 5 working days and respond substantively within 20 working days. If you remain unhappy, you may complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
12. Changes to this policy
If we make a material change, we will email all active subscribers at least 14 days before it takes effect. We will publish the previous version in our archive on request. The current version number and effective date are shown at the top of this page.
13. Related policies
14. Contact
For anything in this policy: hello@theparentbook.com. For complaints we cannot resolve, please contact the Information Commissioner’s Office.
Document version 3.4 · Effective from 31 May 2026, with the changes of 25 and 26 September 2026 · Review date: February 2027 · Owner: Sam McManus, Sole Director and Data Protection Lead, Kensington Square Therapy Ltd.