Privacy policy

The processing of your personal data is carried out in accordance with and within the limits of applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) - hereinafter referred to as the “GDPR”.

This Privacy Policy applies to the processing of data in connection with your use of the group of websites operating under the common domain address https://thestory.is/ and https://thestory.consulting.pl

1. The Controller of your personal data is Story Design Spółka z ograniczoną odpowiedzialnością, with its registered office in Warsaw at ul. Twarda 18, 00-105 Warsaw, Poland, REGON: 146732514, NIP: 7010384365, KRS: 0000465952 (hereinafter referred to as the “Controller” or the “Company”).

- Contact details: email: biuro@thestory.pl

2. The Controller has appointed a Data Protection Officer. The Data Protection Officer may be contacted regarding all matters relating to your personal data.

- Contact details: email: gdpr@thestory.pl

1. WORKSHOP REGISTRATION

To the extent that your personal data is processed in connection with your registration for workshops organized or co-organized by the Controller, your personal data, including your first name, last name, email address, job position, company name, country of residence/registered office, tax identification number (NIP), and bank account number, is processed for the following purposes:

a) to provide the service consisting of organizing or co-organizing workshops - pursuant to Article 6(1)(b) of the GDPR, as processing is necessary for the performance of a contract or for taking steps at your request prior to entering into a contract;

b) to comply with legal obligations imposed on the Controller, including, in particular, tax obligations - pursuant to Article 6(1)(c) of the GDPR;

c) to establish, pursue, or defend against potential claims related to your participation in the workshops - pursuant to Article 6(1)(f) of the GDPR.

2. ELECTRONIC (EMAIL) OR TELEPHONE CONTACT WITH THE COMPANY

To the extent that your personal data is processed in connection with an inquiry submitted to the Controller using the contact details provided on the Website (email address or telephone number), your personal data is processed for the purpose of responding to your inquiry. The legal basis for processing your personal data is the necessity of processing for purposes arising from the legitimate interests pursued by the Controller, pursuant to Article 6(1)(f) of the GDPR. The legitimate interest pursued by the Controller is to enable interested persons to contact the Controller by telephone or electronically. If your inquiry concerns the Controller’s services or offer, your personal data may also be processed for the purpose of preparing an offer for you - pursuant to Article 6(1)(b) of the GDPR, as processing is necessary to take steps at your request prior to entering into a contract.

3. NEWSLETTER

To the extent that your personal data is processed in connection with subscribing to the newsletter, your email address is processed for the purpose of sending you the newsletter, i.e. information about updates on the Website. The legal basis for processing your personal data is your voluntary consent, expressed by selecting the appropriate checkbox below the newsletter subscription form - pursuant to Article 6(1)(a) of the GDPR. You have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

4. MARKETING

To the extent that your personal data is processed in connection with your consent to receive other marketing information from the Controller, your email address and/or telephone number is processed for the purpose of providing you with marketing information. The legal basis for processing your personal data is your voluntary consent, expressed in writing or by selecting the appropriate checkbox below the form enabling you to post a comment or subscribe to the newsletter or workshops - pursuant to Article 6(1)(a) of the GDPR. You have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

5. COMMENTS

To the extent that your personal data is processed in connection with posting a comment on the Controller’s Website, your first name, email address and, optionally, the name of your website will be processed for the purpose of publishing the comment and verifying whether the comment is individual or automated and mass-generated (spam). Your email address will not be visible on the Website. The legal basis for processing your personal data in this respect is your voluntary consent, expressed by selecting the appropriate checkbox below the form enabling you to post a comment - pursuant to Article 6(1)(a) of the GDPR. You have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

6. COOKIES

Regardless of the above, your data is processed using so-called cookies, in accordance with the Cookie Policy adopted by the Controller. The Controller uses cookies to maintain user session information and to conduct statistical analyses using Google Analytics. The Controller does not use cookies for advertising profiling. The legal basis for processing data in this respect is the necessity of processing for purposes arising from the legitimate interests pursued by the Controller, pursuant to Article 6(1)(f) of the GDPR. The legitimate interest pursued by the Controller is to facilitate the use of the Website and to collect general statistical information about the level of interest in the content published on the Website.

1. Your personal data may be entrusted for processing to entities cooperating with the Controller under data processing agreements concluded pursuant to Article 28 of the GDPR. In particular, the Controller may entrust data processing to entities providing hosting services, email services, IT services, and accounting services.

2. Your personal data is processed by persons authorized by the Controller to process data pursuant to Article 29 of the GDPR, including, in particular, members of the Company’s governing bodies and persons employed by the Company.

3. Your personal data may be transferred to a third country outside the European Economic Area:

a) to the United States, due to the use of processing services provided by Amazon Web Services Inc., based in the USA, and Google LLC, based in the USA. These entities participated in the EU-US Privacy Shield Framework. The EU-US Privacy Shield was adopted by European Commission Implementing Decision No. 2016/1250 of 12 July 2016, which established that the United States provided an adequate level of protection for personal data transferred from the European Union to entities in the United States under the EU-US Privacy Shield. More information about the Privacy Shield program can be found at www.privacyshield.gov. Accordingly, the transfer of your personal data is compliant with Article 45 of the GDPR and is based on an adequacy decision issued by the European Commission (Article 45(1) of the GDPR).

1. WORKSHOP REGISTRATION

To the extent that your personal data is processed in connection with registration for workshops organized or co-organized by the Controller, your personal data will be stored until the Controller has fulfilled its legal obligations, including, in particular, obligations concerning the retention of documentation for tax purposes. Your personal data may also be stored until the expiry of any potential claims arising from your participation in workshops organized by the Controller.

2. ELECTRONIC (EMAIL) OR TELEPHONE CONTACT WITH THE COMPANY

To the extent that your personal data is processed in connection with an inquiry submitted to the Controller using the contact details provided on the Website (email address or telephone number), your personal data will be stored, in the case of electronic correspondence, until the correspondence concerning your inquiry has ended, and, in the case of telephone conversations, until the conversation has ended, unless it is not possible to answer your inquiry during the initial telephone conversation and you consent to being contacted at a later date. If your inquiry concerns the Controller’s offer and results in you entering into a contract with the Controller, your personal data will continue to be stored for the purpose of performing that contract.

3. NEWSLETTER

To the extent that your personal data is processed in connection with subscribing to the newsletter, your personal data will be stored until you withdraw your consent to receive the newsletter or until the Controller ceases to distribute the newsletter. You may unsubscribe from the newsletter at any time using the link included in every newsletter.

4. MARKETING

To the extent that your personal data is processed in connection with your consent to receive other marketing information from the Controller, your personal data will be stored until you withdraw your consent to receive marketing information, but no longer than five years from the date on which consent was obtained, unless you reconfirm your consent before this period expires.

5. COMMENTS

To the extent that your personal data is processed in connection with publishing a comment on the Controller’s Website, your personal data will be stored until your comment is deleted, either at your request or in connection with the removal of the relevant post from the Controller’s Website.

6. COOKIES

Data collected using cookies will be processed:

a) in the case of “session” (temporary) cookies - until you leave the Website;

b) in the case of “persistent” cookies - until the cookies expire.

You may delete cookies from your device at any time and change your web browser settings to prevent cookies from being used.

7. RECRUITMENT

To the extent that your personal data is processed in connection with your interest in working with us, personal data contained in application documents you submit and collected during the recruitment process will be stored for up to two years after the recruitment process has ended, solely for internal analytical purposes and to defend against potential claims.

If you consent to participate in future recruitment processes, your personal data will be processed for a period of three years, unless you withdraw your consent earlier. Such withdrawal will not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

1. You have the right to:

a) access your personal data, including obtaining confirmation from the Controller as to whether personal data concerning you is being processed and, where this is the case, obtaining access to such data and the information specified in Article 15 of the GDPR;

b) request the Controller to immediately rectify your personal data that is inaccurate, including requesting completion of incomplete personal data, under the terms specified in Article 16 of the GDPR;

c) request the Controller to immediately erase your personal data where the circumstances specified in Article 17 of the GDPR apply, including, in particular, where the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

d) request the Controller to restrict processing in the cases specified in Article 18 of the GDPR, including, in particular, where you contest the accuracy of your personal data;

e) object, within the meaning of Article 21 of the GDPR, on grounds relating to your particular situation, to the processing of your personal data;

f) data portability in the cases specified in Article 20 of the GDPR.

To exercise the rights listed in paragraph 1, please contact the Controller or the Data Protection Officer appointed by the Controller.

1. You have the right to lodge a complaint with a supervisory authority if, in your opinion, your personal data is being processed in violation of applicable law.

2. The authority competent to receive complaints concerning personal data protection is the President of the Personal Data Protection Office (UODO).

1. WORKSHOP REGISTRATION

Providing your personal data to the extent specified by the Controller is necessary to register for workshops organized or co-organized by the Controller. Refusal to provide the required personal data will make it impossible to register for the workshops.

2. ELECTRONIC (EMAIL) OR TELEPHONE CONTACT WITH THE COMPANY

Providing your email address and telephone number in connection with telephone or electronic contact is automated in nature. Providing any additional personal data is entirely voluntary, although it may be necessary to respond to your inquiry. In such a case, a representative of the Controller will inform you of the necessary scope of personal data, allowing you to decide whether to provide such data or refuse to provide it.

3. NEWSLETTER

Providing your email address is necessary to receive the newsletter. Refusal to provide this data will prevent the newsletter from being sent to you but will have no other negative consequences.

4. MARKETING

Providing your telephone number and/or email address is necessary to receive marketing information. Refusal to provide this data will prevent marketing information from being sent to you but will have no other negative consequences.

5. COMMENTS

Providing your first name and email address is necessary to post a comment. Refusal to provide this data will prevent you from posting a comment on the Controller’s Website. Providing any other personal data is entirely voluntary and is not necessary to post a comment.

6. COOKIES

Data collected using cookies is collected automatically. You may change your web browser settings at any time to prevent cookies from being used. However, the Controller notes that this may result in difficulties in using the Controller’s Website.

7. RECRUITMENT

Providing your personal data to the extent specified by the Controller is necessary to participate in the recruitment process. Refusal to provide this data will prevent you from participating in the recruitment process but will have no other negative consequences.

You are not subject to decisions based on automated processing, including profiling.

The Controller provides answers to questions and concerns regarding the processing of your personal data and accepts any comments and objections in this regard. You may contact the Controller and the Data Protection Officer appointed by the Controller by email or traditional mail.