Maya's Worldly Wonders Privacy Policy

​

Last updated: 04th October 2026

​

1. Who we are

​

This policy explains how we collect and use personal data when you visit www.mayasworldlywonders.com, buy from us, sign up to our mailing list, book an author visit or meet us at an event.

Maya's Worldly Wonders® is a children's travel-adventure brand. Books and merchandise are sold by South Node Publishing Ltd, a company registered in England and Wales, company number 15775472, registered office: 128 City Road, London, EC1V 2NX.

South Node Publishing Ltd is the data controller for the personal data described in this policy, which means it decides how and why your data is used.

South Node Publishing Ltd is part of a group of companies that includes 11:22 Holdco Ltd, Maya's Worldly Wonders Ltd and Your Own Wave Studios Ltd.

Contact us about privacy: info@southnodepublishing.com, or write to Data Protection, South Node Publishing Ltd, 128 City Road, London, EC1V 2NX.

​

2. The personal data we collect

​

When you buy from our website: your name, email, phone number, billing and delivery address, and order history. Payment card details are handled by our payment providers; we never see or store your full card number.

When you buy from us at an event or pop-up: payment is processed by our card reader provider. If you ask for a receipt by email, we collect your email address.

When you join Maya's Adventure Club (our mailing list): your first name, last name, email address, and whether you open or click our emails.

When you contact us or use a contact form: your name, email, phone number (if given) and the content of your message.

When you book an author visit, talk or workshop: your name, role, organisation (for example a school or company), contact details, event details and any invoicing information.

When you leave a review or testimonial: your name, location and comments. For children, see section 4.

When you enter a competition or giveaway: your name, contact details and, if you win, a delivery address.

When you browse our website: your IP address, device and browser type, pages visited and how you use the site, collected through cookies (see section 5).

We may also receive limited data from third parties, such as order details when you buy through [TikTok Shop / Faire / Shopify, other channel] and we fulfil the order. When you buy from Amazon, a bookshop or another retailer, that retailer is responsible for your data, not us.

We do not knowingly collect special category data, such as health information or religious beliefs. Please do not send us this kind of information.

​

3. How we use your data and our lawful basis

​

UK data protection law requires us to have a lawful basis for each use of your data.

Processing and delivering your order, and handling returns and refunds: contract.

Sending order confirmations and delivery updates: contract.

Keeping financial records and meeting tax obligations: legal obligation.

Sending our newsletter and marketing emails: consent, or soft opt in for existing customers (see section 5).

Replying to enquiries and arranging author visits and events: legitimate interests (responding to people who contact us), or contract once a booking is confirmed.

Publishing reviews and testimonials: consent.

Running competitions and giveaways: consent and contract (the competition terms).

Improving our website and understanding how it is used: legitimate interests, and consent for non-essential cookies.

Preventing fraud and keeping our website secure: legitimate interests.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can object at any time (see section 7).

We do not sell your personal data, and we do not use it for automated decision making that has legal or similarly significant effects on you.

​

4. Children's privacy

​

Our books are written for children, but our website, shop and mailing list are intended for parents, carers, teachers and other adults. We do not knowingly collect personal data directly from children under 13. If you believe a child has given us their details, contact us and we will delete them.

Reviews and testimonials from children. We only publish a child's review with the permission of their parent or carer. We use the child's first name, age and country only (for example "Zarah, aged 9, UK") and never a surname, school or photo without separate written consent. A parent or carer can ask us to remove a child's review at any time.

Author visits and events. When Sharika visits schools, libraries or events, the school or organiser is responsible for pupil data and photography consent. We only publish photos of children where the school or organiser has confirmed that parental consent is in place, and we avoid images that identify individual children by name.

​

5. Marketing, cookies and analytics

​

Marketing emails. We only send marketing emails if you have signed up to Maya's Adventure Club or ticked a box to receive them. If you have bought from us, we may also email you about similar products unless you opted out at checkout (the "soft opt in"). Every email includes an unsubscribe link, or you can contact us to stop them at any time.

Cookies. Our website uses cookies and similar technologies. Essential cookies make the site and checkout work and do not need your consent. Analytics and marketing cookies help us understand how the site is used and measure our advertising, and we only use them if you accept them in our cookie banner. You can change your choice at any time through [the cookie settings link in the footer].

The cookies we use include those set by Wix, our website platform, and [Google Analytics / Meta Pixel / TikTok Pixel: list only those you actually use]. You can also block cookies in your browser settings, though some parts of the site may not work properly.

Social media. If you interact with us on Instagram, TikTok, Facebook or YouTube, those platforms process your data under their own privacy policies.

​

6. Who we share your data with

​

We only share your data with trusted service providers who help us run our business, and only as much as they need. They act on our instructions and must keep your data secure.

Website and online shop platform: Wix.com hosts our website, checkout, mailing list and forms.

Payment processing: [Wix Payments / Stripe / PayPal / SumUp] process our online and in-person card payments.

Delivery and fulfilment: [Royal Mail / Evri / fulfilment partner] pack and deliver your order.

Email marketing: [Wix Email Marketing / other] sends our Maya's Adventure Club emails.

Professional advisers: our accountants and solicitors, for accounting, legal and tax purposes.

We may also share data where the law requires it, for example with HMRC, or to protect our rights, property or customers. If our business, or part of it, is sold or restructured, your data may transfer to the new owner, who must use it in line with this policy.

International transfers. Some of our providers, such as Wix, store or process data outside the UK, including in the United States. Where this happens, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU US Data Privacy Framework.

​

7. Keeping, protecting and controlling your data

How long we keep it:

Order and payment records: 6 years from the end of the financial year, as required for tax.

Mailing list details: until you unsubscribe, after which we keep a suppression record so we do not email you again.

Enquiries and author visit bookings: 2 years after our last contact, unless a booking creates financial records.

Reviews and testimonials: while published, or until you ask us to remove them.

Competition entries: 6 months after the competition ends.

Security. We use appropriate technical and organisational measures to protect your data, including secure, password-protected systems and encrypted payment processing. If we become aware of a data breach that affects you, we will tell you and the ICO where the law requires it.

Your rights. Under UK data protection law, you have the right to:

• ask for a copy of the personal data we hold about you

• ask us to correct data that is wrong or incomplete

• ask us to delete your data

• ask us to restrict how we use your data

• object to us using your data, including for direct marketing

• ask us to transfer your data to another organisation

• withdraw your consent at any time, where we rely on consent

To use any of these rights, contact us using the details in section 1. We will respond within one month and there is normally no charge.

​

Complaints. If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

​

Changes to this policy. We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.