Privacy Policy

1. Controller

Jürgen Fauth
c/o IP-Management #5199
Ludwig-Erhard-Str. 18
20459 Hamburg
Germany

Email: jurgen@storyflowmentor.de

Imprint: Imprint

2. Overview of Processing Activities

Types of data processed

• Inventory data (e.g. name)
• Contact data (e.g. email address)
• Content data (e.g. entries in forms, project descriptions)
• Usage data (e.g. pages visited, time of visit)
• Meta/communication data (e.g. IP addresses)

Categories of data subjects

• Customers and interested parties
• Users of the website
• Subscribers to newsletter or notifications

Purposes of processing

• Provision of contractual services and fulfilment of contractual obligations
• Contact and enquiry management
• Security measures
• Direct marketing and reach measurement
• Website analytics and optimisation
• Management and response to enquiries

3. Legal Bases

We process personal data in compliance with the EU General Data Protection Regulation (GDPR). The relevant legal bases are:

• Consent (Art. 6(1)(a) GDPR): Processing based on your freely given consent.
• Contract performance (Art. 6(1)(b) GDPR): Processing necessary to fulfil a contract or pre-contractual steps.
• Legal obligation (Art. 6(1)(c) GDPR): Processing required to comply with a legal obligation.
• Legitimate interests (Art. 6(1)(f) GDPR): Processing necessary for purposes of our legitimate interests, provided these do not override your fundamental rights.

In addition to the GDPR, German national data protection law applies, in particular the Federal Data Protection Act (BDSG).

4. Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, implementation costs, and the nature and purposes of processing. These measures include securing the confidentiality, integrity and availability of data through physical and electronic access controls.

5. Data Transfers

In the course of our processing activities, personal data may be transferred to third parties. Recipients may include IT service providers or providers of services and content integrated into our website. In all such cases we comply with applicable law and have concluded appropriate data processing agreements.

6. International Transfers

Where we transfer data to a third country (outside the EU/EEA), we do so in compliance with legal requirements. For transfers to the USA we rely primarily on the EU–US Data Privacy Framework (DPF), recognised as an adequate safeguard by the European Commission (decision of 10 July 2023). We have also concluded standard contractual clauses with the relevant providers.

For more information on the DPF and a list of certified companies see: dataprivacyframework.gov.

7. Data Retention and Deletion

We delete personal data as soon as the underlying consent is revoked or there is no longer a legal basis for processing. Under German law, the following general retention periods apply:

• 10 years: tax-relevant documents (§147 AO)
• 6 years: commercial documents (§257 HGB)

8. Your Rights

As a data subject under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR): You may request information about personal data we hold about you.
• Right to rectification (Art. 16 GDPR): You may request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): You may request deletion of your data under certain conditions.
• Right to restriction (Art. 18 GDPR): You may request restriction of processing under certain conditions.
• Right to data portability (Art. 20 GDPR): You may request your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests at any time.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in your EU member state of residence or the state where the alleged infringement took place.

9. Business Services

We process data of our contractual and business partners (e.g. clients and interested parties) in the context of contractual and comparable legal relationships and related communications. The data is processed to provide our contractual services, respond to enquiries, and comply with legal obligations. Data is deleted when no longer required and retention periods have expired.

Legal basis: contract performance (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

10. Hosting and Website Provision

To provide this website we process user data, including IP addresses, which are necessary to deliver content to the user's browser or device. This website is hosted via Netlify (Netlify, Inc., 44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA). We have concluded a data processing agreement with Netlify. Data is transferred to the USA on the basis of the EU–US Data Privacy Framework and standard contractual clauses.

Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

11. Cookies

Cookies are functions that store and retrieve information on users' devices. We use cookies in compliance with applicable law. Where required, we obtain prior user consent. Temporary (session) cookies are deleted when a user leaves the website. Persistent cookies remain stored after the device is closed; the storage period may be up to two years.

You may withdraw consent at any time and object to processing via your browser's privacy settings.

12. Contact and Enquiry Management

When you contact us (e.g. via the contact form, email, or social media), we process the information you provide to the extent necessary to respond to your enquiry and any associated measures.

Contact form submissions are processed via Formspree (Formspree, Inc., USA). We have concluded a data processing agreement with Formspree. Data is transferred to the USA on the basis of the EU–US DPF and standard contractual clauses.

Legal basis: contract performance / pre-contractual measures (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Data is deleted when no longer required, typically after the enquiry has been conclusively resolved, unless retention is required by law.

13. Newsletter and Electronic Notifications

We send newsletters and other electronic notifications only with recipients' consent or on a legal basis. To subscribe, providing your email address is sufficient. We use a double opt-in procedure: after signing up you will receive a confirmation email with a verification link.

You may unsubscribe at any time using the unsubscribe link in any newsletter email or by contacting us directly.

Legal basis: consent (Art. 6(1)(a) GDPR).

14. Web Analytics: Google Analytics

We use Google Analytics 4 to analyse user behaviour on this website, allowing us to evaluate usage and improve our services. Google Analytics 4 uses cookies and similar technologies that enable analysis of your usage patterns. The data collected is generally transferred to a Google server in the USA and stored there.

Google Analytics is only activated with your consent. You can grant or withdraw consent via the cookie banner shown on your first visit.

Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Privacy policy: policies.google.com/privacy.

Legal basis: consent (Art. 6(1)(a) GDPR).

Data transfer to the USA is based on the EU–US Data Privacy Framework and Google's standard contractual clauses.