1. Privacy Policy (GDPR & CCPA)
Regulation (EU) 2016/679 · California Consumer Privacy Act
1.1 Controller. StorylineCraftHouse, registered at 38124 Else-Hoppe-Str. 12 Braunschweig, Germany, is the data controller for personal data processed through storylinecrafthouse.com and related correspondence. Privacy inquiries may be directed to [email protected].
1.2 Categories of data. We process identification and contact data (name, email address, phone number, company name), transactional data (selected services, invoices, payment confirmations), correspondence data (project briefs, feedback messages), and technical data (IP address, browser type, referring URL, cookie identifiers, approximate location derived from IP).
1.3 Purposes and legal bases. Contact and inquiry data is processed to respond to requests and prepare quotations under Art. 6(1)(b) GDPR (pre-contractual measures). Contractual data is processed to deliver commissioned copywriting and documentation services under Art. 6(1)(b). Invoices and bookkeeping records are retained under Art. 6(1)(c) in fulfillment of German statutory retention obligations (§147 AO, §257 HGB), typically ten years for accounting records. Technical data and non-essential cookies are processed only with consent under Art. 6(1)(a) GDPR and §25 TDDDG. Legitimate-interest analyses under Art. 6(1)(f) cover site security, abuse prevention, and service improvement.
1.4 Recipients. Data is shared exclusively with processors bound by Art. 28 GDPR agreements: our EU-hosted email and hosting providers, project collaboration tools, and Stripe for payment processing. Personal data is not sold, rented, or disclosed to advertising brokers.
1.5 International transfers. Primary storage occurs within the European Union. Where a processor operates outside the EEA, transfers rely on European Commission Standard Contractual Clauses supplemented by appropriate technical safeguards.
1.6 Retention. Inquiry data not converted into a contract is deleted within 12 months of the last meaningful contact. Contractual records are retained for the statutory limitation period plus mandatory bookkeeping periods. Consent-based records are deleted upon withdrawal of consent.
1.7 Your rights. Under GDPR Chapters II and III you may request access, rectification, erasure, restriction, data portability, and object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting prior lawfulness. You have the right to lodge a complaint with a supervisory authority, notably the Landesbeauftragte für den Datenschutz Niedersachsen (Braunschweig, Germany).
1.8 CCPA disclosures (California residents). We do not "sell" or "share" personal information as defined by the CCPA/CPRA. California consumers may request disclosure of categories and specific pieces of collected data, deletion, and correction of inaccurate data, and may designate an authorized agent. Requests are honored within the statutory 45-day window and verified before fulfillment. We apply non-discrimination: exercising privacy rights does not alter pricing or service quality. Direct requests to [email protected] with the subject line "CCPA Request".
1.9 Security. Transmission channels use TLS encryption; resting data is stored on access-controlled systems with role-based permissions, current patching, and encrypted backups.