Global Privacy Policy

This Global Privacy Notice explains how the companies of The Storytelling Company group process personal data when you visit our websites, contact us, subscribe to our newsletter, use The Storytelling Suite, or interact with our online services. It is written as one common notice so that the relevant group entities and their respective roles are transparent.

Recruitment is covered by a separate Candidate Privacy Notice linked from our careers pages. Where a customer agreement, data processing agreement or another specific notice applies, that document supplements this notice and governs the processing it describes.

1. Scope and the responsible entities

The Storytelling Company operates through the following entities. The entity responsible for a particular processing activity depends on your location, the service you use and the contractual relationship involved. The applicable entity will be identified in the relevant form, contract or notice where this distinction matters.

The Storytelling Company B.V.

Suikersilo-West 37, 1165 MP Halfweg, the Netherlands. KVK 55546412; VAT ID NL851760132B01.

Role in this notice: central group contact and, unless stated otherwise, controller for the website-related processing described in this notice.

The Storytelling Company GmbH

August-Everding-Straße 25, 81671 Munich, Germany.

Role in this notice: controller for processing connected with German operations and the newsletter service where the subscription flow identifies the GmbH as controller.

The Storytelling Company Inc.

4111 Rose Lake Dr, Suite A, Charlotte, NC 28217, United States.

Role in this notice: controller for processing connected with US operations and US customer or business relationships, where applicable.

Contact

Central privacy contact: compliance@storytellingcompany.com

General enquiries: info@storytellingcompany.com

Central contact person: Joost Rueck

For the EU entities, our Data Protection Officer can be reached through the central privacy contact above. Please include enough information for us to identify your request and, where relevant, the group entity or service to which it relates.

2. Personal data we process and why

We process personal data only for defined business purposes and only to the extent reasonably necessary for those purposes. The sections below summarise the main processing activities. The EU legal bases apply where an EU entity is controller; the US entities rely on applicable US law and legitimate business purposes for comparable processing.

Website access

Data: IP address, browser and device information, operating system, referrer URL, pages requested, date and time of access.

Purpose and legal basis: deliver the website, maintain security and stability, prevent misuse and investigate security incidents. EU basis: Art. 6(1)(f) GDPR.

Retention: normally 14 days in server logs, then automatic deletion. Longer only where needed for an ongoing security investigation or legal claim.

Contact enquiries

Data: name, company, email address, message and any information you choose to provide through Webflow or email.

Purpose and legal basis: respond to your enquiry, prepare or perform a contract, and maintain business correspondence. EU bases: Art. 6(1)(b), (f) or, where applicable, (a) GDPR.

Retention: normally 12 months after the last exchange. Contractual, tax or commercial records may be retained for applicable statutory periods.

Newsletter subscription

Data: email address, optional name, subscription status and double-opt-in records.

Purpose and legal basis: send the newsletter and document consent. EU basis: Art. 6(1)(a) GDPR; applicable electronic marketing laws also apply.

Retention: until you unsubscribe or the data is no longer needed. An unsubscribe or suppression record may be retained for as long as necessary to prevent a renewed subscription against your wishes.

Cookie preferences

Data: consent choices, timestamp, device and technical information recorded by Cookiebot.

Purpose and legal basis: store and demonstrate your cookie choices and block non-essential technologies until consent is given. EU bases: legal obligation and legitimate interest in demonstrating compliance.

Retention: for as long as the consent record is needed to demonstrate and manage your choice.

Analytics data

Data: information generated by Google Analytics 4 after consent, such as events, device information and pseudonymous identifiers.

Purpose and legal basis: understand how visitors use the website and improve its content and performance. EU basis: Art. 6(1)(a) GDPR and prior consent under applicable cookie rules.

Retention: Google Analytics retention setting: 14 months. Google may retain information under its own terms where it acts independently.

The Storytelling Suite

Data: account, authentication, support, billing and usage data, plus customer data held in a customer tenant.

Purpose and legal basis: provide, secure and support the platform, administer the customer relationship and comply with legal obligations. The customer-tenant role is described in Section 8.

Retention: for the contract term and applicable legal or claim periods; customer-tenant retention is determined by the customer instructions and agreement.

We do not require special-category data for ordinary website enquiries. Please do not include sensitive information in a contact form unless it is necessary and you have a secure channel agreed with us.

3. Contact enquiries and website forms

Our website contact form is provided through Webflow. If you submit an enquiry, we use the information you provide to respond and, where appropriate, to discuss a potential business relationship. We do not operate a separate CRM for website contact enquiries. The information is processed through Webflow and the relevant email systems used by the responsible group entity.

If your enquiry leads to a contract, relevant correspondence may become part of our contractual, commercial or tax records. Those records may then be retained for the statutory periods applicable to the responsible entity, even if the ordinary 12-month contact period has expired.

4. Newsletter and MailerLite

If you subscribe to our newsletter, we use a double-opt-in process. We send a confirmation message to the address entered during registration and add you to the newsletter distribution list only after confirmation. We use the information to send newsletters and manage your subscription.

MailerLite acts as our newsletter service provider and processes subscriber data on behalf of The Storytelling Company GmbH under the applicable data processing agreement. You can unsubscribe at any time using the link in each newsletter or by contacting us at compliance@storytellingcompany.com.

After unsubscribing, we may retain your email address or another limited suppression record for as long as necessary to ensure that we do not add you to the newsletter again without a new request or valid consent. This is a technical safeguard and not an active newsletter subscription.

5. Cookies, consent and analytics

We use Cookiebot as our consent management platform. On your first visit, the consent banner allows you to accept or reject non-essential categories separately. You can change your choice at any time through the Cookie Settings link in the website footer. Non-essential technologies are blocked until you consent. The current Cookie Declaration on the website lists the individual cookies, providers, purposes and expiry periods.

Necessary

Core website functions, security and load balancing, including services such as Webflow, Cloudflare and Cookiebot. These technologies are used only where permitted without consent under the applicable law.

Statistics

Google Analytics 4 measures website use only after you consent. Google Signals and remarketing are not enabled for our configuration.

Marketing / external content

The current website links to LinkedIn, Instagram and YouTube. A link does not transmit data to the linked platform merely because the page is displayed. If an external media element is introduced in the future, it will be assessed and, where required, blocked until consent.

Video and media delivery

Bunny may be used to deliver video or other media content. Bunny is described as a media-delivery provider, not as a social-media service. Technical request data may be processed when media is requested.

Google Analytics 4 is not loaded before consent in regions where prior consent is required. The legal requirements for device access and cookies are assessed under the applicable local rules, including § 25 TDDDG in Germany and art. 11.7a of the Dutch Telecommunications Act in the Netherlands.

LinkedIn Insight Tag

We use the LinkedIn Insight Tag, a JavaScript-based analytics and conversion tracking tool provided by LinkedIn Ireland Unlimited Company, to measure the effectiveness of our job postings on LinkedIn. The tag helps us understand how many visitors access our careers pages from LinkedIn job postings and subsequently interact with our careers pages or submit an application through our recruitment platform. For this purpose, LinkedIn may process information such as your IP address, browser and device information, referring URL, page views and interactions with our careers pages. The LinkedIn Insight Tag is only activated after you have given your consent via our cookie banner. The legal basis for this processing is your consent pursuant to Article 6(1)(a) GDPR and, insofar as information is stored in or accessed from your device, Section 25(1) TDDDG. You can withdraw or change your consent at any time via Cookie settings. For more information about how LinkedIn processes personal data, please see LinkedIn’s Privacy Policy and Cookie Policy.

6. External media and links

Our websites may contain links to third-party services, including LinkedIn, Instagram, YouTube and map services. When you follow a link, the third party becomes responsible for the subsequent processing. Its own privacy notice and terms apply. We do not control the processing carried out on third-party websites.

Bunny is used, where applicable, for the technical delivery of video or media content. It is not treated as a social-media platform in this notice. The technical information required to deliver requested content may include an IP address, browser information, device information and request metadata.

7. Careers and applications

Applications submitted through our careers pages are processed through Personio. Recruitment processing is covered by our separate Candidate Privacy Notice. That notice identifies the applicable controller, explains the categories and purposes of processing, describes recipients and sets out the applicable retention periods.

The Candidate Privacy Notice applies specifically to application data and takes precedence over this general notice for recruitment processing. Please ensure that the version linked from the careers page remains aligned with the responsible entity and current retention practice.

8. The Storytelling Suite

The Storytelling Suite is a platform provided to customers under a customer agreement. We distinguish between two roles:

• Account and relationship data. We may process the names, business contact details, authentication data, billing information and support correspondence of customer contacts as controller in order to administer the account, provide support, secure the platform and comply with legal obligations.

• Customer-tenant data. Where a customer uses The Storytelling Suite to process personal data about its own employees, participants or other individuals, the customer normally determines the purposes and means of processing and acts as controller. The relevant TSC group entity acts as processor on the customer’s instructions. The customer agreement and a separate Art. 28 GDPR data processing agreement govern that processing.

The Storytelling Suite may use cloud infrastructure, including Amazon Web Services, for hosting and operation. The applicable customer agreement and data processing agreement contain further details on security, subprocessors, locations, international transfers and deletion.

9. Service providers and international transfers

We use carefully selected service providers to operate our websites, communications and platform. Depending on the activity, a provider may act as our processor, an independent controller or another recipient. Where an EU entity transfers personal data outside the European Economic Area, we use an adequacy decision, the EU Standard Contractual Clauses or another valid safeguard under Articles 44 to 49 GDPR, as applicable.

Webflow, Inc.

Service: website hosting and contact-form processing.

Location and safeguard: United States and other infrastructure locations. EU–US Data Privacy Framework where applicable; otherwise appropriate safeguards such as Standard Contractual Clauses.

Cloudflare, Inc.

Service: content delivery, security and protection against misuse.

Location and safeguard: United States / global network. EU–US Data Privacy Framework where applicable and/or Standard Contractual Clauses and related safeguards.

Google Ireland Ltd. / Google LLC

Service: Google Analytics 4 after consent.

Location and safeguard: EEA / United States. EU–US Data Privacy Framework where applicable and/or Standard Contractual Clauses, depending on the service and transfer.

Cybot A/S (Cookiebot)

Service: consent management and consent records.

Location and safeguard: Denmark / European Union.

MailerLite

Service: newsletter distribution and subscriber management on behalf of the responsible entity.

Location and safeguard: the contractual entity and processing locations stated in the applicable MailerLite agreement. Appropriate safeguards apply where a transfer outside the EEA occurs.

Bunny

Service: delivery of video and other media content.

Location and safeguard: international infrastructure. Appropriate safeguards apply where required by applicable law.

Amazon Web Services

Service: hosting and operation of The Storytelling Suite.

Location and safeguard: EEA hosting where selected; otherwise appropriate safeguards, including Standard Contractual Clauses where required.

Personio

Service: online application processing.

Location and safeguard: recruitment processing as described in the separate Candidate Privacy Notice.

The Storytelling Company Inc. is located in the United States and may process or receive personal data in connection with US operations. For individuals in the EEA, any transfer to the United States is made only with an applicable legal safeguard.

10. Retention periods

We keep personal data only for as long as it is needed for the stated purpose, unless a longer period is required or permitted by law. The main periods are:

• Server logs: 14 days, unless needed longer for an ongoing security incident or legal claim.

• Contact enquiries: 12 months after the last exchange, unless the information becomes part of a contract, dispute or statutory record.

• Newsletter subscription: until unsubscribe or the subscription is otherwise closed. A limited suppression record may remain as long as necessary to respect the opt-out.

• Cookie consent records: for as long as necessary to manage and demonstrate the consent decision.

• Google Analytics 4: 14 months for the configured analytics retention period; Google’s own retention may apply where Google acts independently.

• TSS customer and account data: for the customer relationship and the applicable legal, contractual and claim periods. Customer-tenant data follows the customer agreement and instructions.

• Commercial and tax records: for the statutory periods applicable to the responsible group entity. In Germany, this may include six-year and ten-year periods; Dutch fiscal records may be retained for up to seven years, depending on the record.

• Applications: as stated in the separate Candidate Privacy Notice.

11. Your rights in the EEA

If an EU entity processes your personal data, you may have the following rights under the GDPR and applicable national law:

• Access to your personal data and information about how it is processed.

• Rectification of inaccurate or incomplete data.

• Erasure of your data, subject to statutory exceptions.

• Restriction of processing in the circumstances provided by law.

• Data portability for data you have provided to us, where the legal requirements are met.

• Object to processing based on legitimate interests, and to direct marketing at any time.

• Withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing carried out lawfully before withdrawal.

To exercise your rights, contact compliance@storytellingcompany.com. We may need to verify your identity before responding. We generally respond within one month, subject to the extensions permitted by Art. 12(3) GDPR.

You may also lodge a complaint with the competent supervisory authority. For The Storytelling Company GmbH, this is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany. For The Storytelling Company B.V., this is the Autoriteit Persoonsgegevens, Hoge Nieuwstraat 8, 2514 EL Den Haag, the Netherlands. You may also contact the authority in your habitual residence, place of work, or the place of the alleged infringement.

12. US privacy rights, including North Carolina

If you are in the United States, including North Carolina, applicable federal and state privacy laws may provide you with rights concerning your personal information. Depending on the law that applies to you, these may include the right to know or access the categories and specific pieces of information we hold, request deletion, request correction, obtain a portable copy, opt out of targeted advertising or certain disclosures, limit the use of sensitive personal information, appeal a decision and receive equal treatment for exercising your rights.

We do not sell personal information and do not share personal information for cross-context behavioural advertising. We do not knowingly collect Social Security numbers, government identification numbers, precise geolocation, biometric information or other sensitive personal information through the ordinary website contact form. These statements do not limit rights that apply under a particular state law.

To make a privacy rights request, email compliance@storytellingcompany.com with the subject line “Privacy Rights Request”. We may ask for information needed to verify the request and protect against unauthorised disclosure. We will respond within the time required by applicable law. You may use an authorised agent where permitted by law.

13. Automated decision-making and children

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR to make decisions that produce legal effects or similarly significantly affect you.

Our websites and services are directed at business contacts and are not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will take reasonable steps to delete it.

14. Security, changes and contact

We use appropriate administrative, technical and organisational safeguards designed to protect personal data against unauthorised access, loss, misuse, alteration and disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We may update this notice when our processing activities, services or legal obligations change. The version published on the relevant website at the time of your visit applies to the processing described there. If a change is material, we will provide additional notice where required.