Who is responsible
Vista Publishers operates the Vista Publishers website at vistapublishers.com and is the controller of the personal information described here. Our main office and privacy contact details appear below. We support individual authors and business customers internationally.
Information we receive
The inquiry form collects your name, email, optional phone number, country, manuscript language and stage, required services and message. Later correspondence may include project files, instructions, approvals, contract and billing information that you provide. Please share only information needed for your project and ensure you may lawfully share information about other people.
Our server receives connection information, including an IP address, requested pages and technical request details. Hosting providers may keep operational and security logs. Where the host supplies a country code, it can help choose the initial language. We do not use an external IP lookup service.
This website has no customer accounts, payment checkout or manuscript upload facility. The optional downloadable project brief is generated in your browser; downloading it does not send its contents to us.
Why we use it and our legal bases
Where UK or EU data protection law applies, we rely on the following bases:
- Contract or steps you request before a contract: responding to your own project inquiry and performing agreed services.
- Legitimate interests: managing business-client contacts, ordinary correspondence, protecting the website against abuse and establishing or defending legal claims. We consider your rights when relying on these interests.
- Legal obligations: keeping records and making disclosures required by applicable tax, accounting or other laws.
- Consent, where required: any optional marketing or other additional use requiring permission. An inquiry is not consent to unrelated marketing. You can withdraw consent without affecting earlier lawful processing.
Service providers and international handling
Information is available to people and providers who need it for the relevant task, such as authorised project staff, hosting and email providers, agreed project suppliers and professional advisers. When configured, the inquiry form sends an email through our configured email provider (cPanel SMTP) to our designated mailbox. A configured Redis service may hold short-lived security counters; it does not receive your message content from the rate limiter. We may disclose information where legally required.
Provider locations can differ from your country, and processing may take place outside the UK or EEA. Before making a restricted transfer, we must establish a lawful mechanism, such as an applicable adequacy decision or approved contractual safeguards with any necessary supplementary measures. Contact us for the providers, destinations and safeguards relevant to your project, or a copy of applicable safeguards. We do not promise that all information stays in a particular country.
Cookies and language preferences
An explicit language choice is saved in the vista-language cookie for up to one year and in browser local storage until you clear it. The previous publishinghub-language-choice preference may also be read. These preferences keep your chosen language; opening a specific language URL does not trigger a country-based redirect.
You can change the language using the switcher and remove saved preferences through your browser settings. If enabled by our team, Google Analytics loads only after you accept analytics. Google receives website usage and device information to help us understand visits. Advertising features are disabled. Your choice is stored locally for 180 days; analytics cookies are configured for up to 180 days. You can reject analytics or withdraw consent through Analytics settings in the footer. Withdrawal stops future collection and removes accessible Analytics cookies; it does not erase data already received by Google. Google may process data outside your country. Analytics retention is configured in our Google Analytics account. No third-party social embeds are used. External links take you to services with their own privacy practices.
How long information is kept
Inquiry correspondence is retained while we respond and consider a project, and afterwards only where needed for a continuing relationship, a complaint or a legal obligation. Project, contract and billing records are retained for the applicable statutory record-keeping and legal-claim periods. We assess the purpose, sensitivity, legal requirements and whether a dispute is ongoing when deciding when to delete or anonymise records. Contact us for the period applicable to a particular record.
Inquiries are stored in a private server database for authorised staff to review and follow up, using the retention criteria above. Administrator sessions expire after eight hours and use an essential login cookie. Email delivery providers and our mailbox may retain messages. Security rate-limit counters use a keyed hash of network information and a 15-minute window. Expired memory entries are removed on a later request; configured Redis counters expire automatically. Hosting logs and mailbox backups follow the relevant provider’s retention arrangements.
Your privacy rights
Depending on the law and circumstances, you can request access, correction, deletion, restriction and a portable copy of information. You can object to processing based on legitimate interests and object to direct marketing at any time. Some rights have legal exceptions; they do not automatically require deletion of records we must lawfully retain.
Use the contact details below to make a request. We may need proportionate information to verify identity. Under UK/EU GDPR, we normally respond within one month, with a permitted extension for complex or multiple requests and an explanation where applicable. You may complain to the ICO or your local competent data protection authority without giving up other remedies.
Contact the UK Information Commissioner’s Office (ICO)Security and information you choose to provide
We use measures such as server-side validation, access credentials and abuse controls, but no internet or email service is completely secure. Avoid sending sensitive personal information, complete manuscripts or financial credentials through the initial inquiry form. Required fields help us understand and answer your request; without them the form cannot be submitted, but you can contact us by email or telephone.
Our services are intended for adults or authorised adult representatives. Please do not submit children’s personal information unnecessarily. We do not make decisions with legal or similarly significant effects solely by automated processing; automated controls may reject spam or excessive requests.
Changes to this policy
The date above identifies this version. We will update this policy when our practices change and provide additional notice or obtain permission where the law requires. Material new uses of your information must have an appropriate legal basis.