Privacy notice
The short version
- We ask for one thing: your email address. Nothing else — not your name, not your child's.
- We use it for two emails: the free printable, and one message when the first book is out.
- We never sell, rent or share your address with anyone for their own marketing.
- This website sets no cookies and runs no analytics or tracking.
- You can leave whenever you like — one click in any email, or email us and we will delete you.
1. Who we are
Say Hello Mundo is a trading brand of OPILIO CREATIVE LIMITED, a company registered in England and Wales under company number 17342111. Our registered office address is on the public register at Companies House.
OPILIO CREATIVE LIMITED is the data controller for the personal data described in this notice. That means we decide why and how your data is used, and we are legally responsible for looking after it.
For anything at all to do with your data — questions, corrections, or a request to be deleted — email hello@sayhellomundo.com. A person reads it.
2. What we collect
| What | When | Why |
|---|---|---|
| Your email address | When you join the waitlist | To send you the free printable and to tell you once when the first book is published |
| Whether you opened or clicked an email | Automatically, by our email provider | So we can stop emailing people who are plainly not interested. We do not build profiles or score anyone. |
That is the complete list. We do not collect your name, your address, your phone number, your payment details, your child's name or age, or your location. We ask for the minimum that lets us do the one thing you asked us to do.
We do not knowingly collect data about children. This waitlist is for grown-ups. If you believe a child has given us their email address, tell us at hello@sayhellomundo.com and we will delete it.
3. Our lawful basis
We rely on your consent — Article 6(1)(a) of the UK GDPR. You give it by pressing the button on the waitlist form, which does one thing and one thing only: asks us to email you. The line beside that button states exactly what you are agreeing to before you press it, so the consent is specific and informed, and pressing it is the clear affirmative action the law asks for. Our marketing emails are also sent under Regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR), which is why we never add anyone who has not asked us to.
Our email provider also sends you a confirmation email before anything else. Your address is only added to the list once you click the link in it — so consent is captured twice, once by you and once from your own inbox.
Consent means you are in charge. You can withdraw it at any moment, and withdrawing it is as easy as giving it — see section 7. Withdrawing consent does not make anything we did beforehand unlawful, but we will stop immediately from that point.
4. Who else touches your data
We use a small number of companies to run the waitlist. They are our processors: they act on our instructions only, under a written contract, and they may not use your data for their own purposes.
| Who | What they do | Where |
|---|---|---|
| Kit (ConvertKit, LLC) | Stores the mailing list and sends the emails | United States |
| Netlify (Netlify, Inc.) | Hosts this website and keeps short-lived server logs, which include your IP address | United States / global CDN |
| Google Fonts | Serves the two typefaces this page uses | United States / global CDN |
Transfers outside the UK. Kit and Netlify are both based in the United States, so your email address is stored there and your IP address may be logged there. Those transfers are covered by each company's data processing agreement, which incorporates the UK Addendum to the European Commission's Standard Contractual Clauses. In plain terms: there is a binding contract requiring your data to be given protection equivalent to UK law.
Google Fonts. Loading the typefaces sends your IP address to Google. If you would rather that did not happen, we are happy to hear it — email us and we will move the fonts onto our own server.
We will disclose your data to anyone else only where the law requires it. We do not, and will not, sell or rent your email address.
5. Cookies and tracking
This website sets no cookies. There is no Google Analytics, no advertising pixel, no Meta or TikTok tag, no session recording, and no fingerprinting. That is why you were not greeted by a cookie banner — there is nothing to consent to.
Our email provider records whether an email was opened or a link was clicked, in the ordinary way that email works. You can stop that by disabling remote images in your email app, or by unsubscribing.
6. How long we keep it
We keep your email address until we migrate this list to our proper mailing list — at which point we will tell you, and you can stay or go.
If that migration has not happened within 24 months, and you have not opened or clicked anything from us in that time, we delete your address instead. We are not going to sit on an address indefinitely waiting for a plan to happen.
If you unsubscribe, we remove you from the active list straight away. We keep a minimal suppression record — your address and the fact that you opted out — so that we do not accidentally email you again. That is a legal obligation under PECR, not a loophole. If you want that record erased too, ask, and we will erase it.
7. Your rights
Under UK data protection law you have the right to:
- Be informed — which is what this notice is for.
- Get a copy of the personal data we hold about you.
- Have it corrected if it is wrong.
- Have it erased — the "right to be forgotten".
- Restrict how we use it while a question is being sorted out.
- Take it elsewhere in a portable, machine-readable format.
- Object to us using it, including for direct marketing. If you object to marketing, we must stop. No exceptions, no persuading.
- Withdraw your consent at any time.
There is no automated decision-making or profiling in anything we do here.
How to use any of them
Click unsubscribe at the bottom of any email we send, or email hello@sayhellomundo.com. We reply within one month, usually much sooner, and it costs you nothing. We may ask you to confirm the request came from the address in question — that is to protect you, not to slow you down.
8. How we keep it safe
- This site is served over HTTPS, so what you type is encrypted in transit.
- Your address goes straight to our email provider's encrypted storage. We do not keep a copy in a spreadsheet, a shared drive or an inbox.
- Access is limited to the company's two directors, on accounts protected by two-factor authentication.
- We collect so little that there is very little to lose. That is deliberate.
If a breach ever occurred that put your rights at risk, we would report it to the Information Commissioner's Office within 72 hours and tell you without undue delay.
9. Children
Our books are for children; this website is for the adults who buy them. We do not knowingly collect personal data from anyone under 18, and we never ask for anything about your child.
10. Changes to this notice
If we change how we use your data, we will update this page and change the date at the top. If the change is significant — a new purpose, a new processor holding your data — we will email you before it takes effect, and where the law requires it, ask for your consent again.
11. Complaints
Please come to us first at hello@sayhellomundo.com — most things are quickly sorted. But you always have the right to complain directly to the UK's data protection regulator, and you do not need our permission to do it:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 · ico.org.uk/make-a-complaint
OPILIO CREATIVE LIMITED is on the ICO's public register of data controllers under registration reference ZC213526.
← Back to Say Hello Mundo