1. Introduction

Introduction. The protection and privacy of personal data is very important to Storyblok GmbH (“Storyblok”, “we” or “us”. With his privacy policy (the “Privacy Policy”) we inform you how we handle and process your personal data when you access our website, use our Storyblok Services or otherwise interact with us. Furthermore, it informs you about your rights and possibilities. Terms not defined otherwise herein have the meaning set forth in our General Terms and Conditions available under https://www.storyblok.com/legal/terms (“Terms”).

Personal Data. Personal data means any information in connection with personal or factual circumstances relating to an identifiable natural person, such as name, address, e-mail address, telephone number, date of birth, age, gender, social security number, video recordings, photos, voice recordings of persons as well as biometric data.

Applicable Laws. We comply with all applicable laws in the respective applicable version on data protection, including the European General Data Protection Regulation (GDPR), Austrian Data Protection Act (Datenschutzgesetz, DSG), the as well as the Austrian Telecommunications Act (Telekommunikationsgestz, TKG).

Disclaimer. The Storyblok Services are not directed to individuals under the age of 16 years. We do not knowingly collect personal information from individuals under the age of 16 years. If we become aware that an individual under the age of 16 years has provided us with personal data, we will take steps to delete such information. If you become aware that an individual under the age of 16 years has provided us with personal data, please contact our support services.

2. Application of this Privacy Policy

2.1. When does this Privacy Policy apply?

We do process personal data from you in different ways:

• From you as a Website Visitor. We process personal data (such as IP address, name, email address or contact information) you share with us when accessing our website or when interacting with us - either as a visitor, Customer or potential customer of our Storyblok Services.
• From you as a Customer of our Storyblok Services. Our Storyblok Services are made available to our customers on a subscription basis under app.storyblok.com, subject to our Terms. In order to use the Storyblok Services, you - either directly or as an employee or other representative of our business customer and designated by our business customer - are required to sign-up for our Storyblok Services. We process personal data of you as our Customer and when interacting with us as a Customer or prospective Customer of our Storyblok Services.

When we process such data we are a data controller as defined by GDPR. We process your data in compliance with applicable laws and this Privacy Policy.

The exact type of data we collect depends on the relationship we have with you and the product or service you use. Applying your cookie management settings on our website, signing up for a newsletter, requesting to be contacted by our sales team, creating an account for our Storyblok Services, are all examples of actions you take that require you to share certain personal data with us that is specific to that particular interaction.

2.2. When does this Privacy Policy not apply?

When you are a Customer of our Storyblok services we may also process following personal data from you:

• Personal Data included in Customer Content. When you are a customer of our Storyblok Services you can upload and manage a variety of content, such as texts, images, videos or other files to and via our Storyblok Services. Typically, this is editorial or marketing content intended for publication but your Customer Content may contain personal data. We process the personal data you as a business Customer of our Storyblok Services may choose to include as part of your Customer Content.

In this context, Storyblok is a data processor as defined by GDPR and not the controller. Storyblok will only process such data pursuant to our agreement with you. In such case you agree to enter into and be bound by the Storyblok Data Processing Agreement and all attachments thereto, which shall govern the processing of personal data included or part of your Customer Content.

3. Who is responsible for the processing of your personal data?

Storyblok GmbH

Ing. Dominik Angerer

Peter-Behrens-Platz 2

4020 Linz, Austria

Email: legal@storyblok.com

4. How do we protect your personal data?

General. Protection of your data is extremely important to us. We use physical, technical and organizational safeguards designed to protect your information and strive to protect your data in the best possible way.

Technical and organizational measures. We use appropriate technical and organizational security measures to protect your data against manipulation, loss, destruction and unauthorized access or use. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know such data. They will only process your Personal Information on our instructions and they are subject to a duty of confidentiality. We use appropriate technology and invest in technology and infrastructure to protect personal data. Access to our Storyblok Services is password protected. You should be the only person with access to your account. You are responsible for safeguarding the credentials to your account. If your login information is compromised or used without your permission, you need to notify us immediately so we can take steps to secure your account.

Certifications. Storyblok has implemented an information security system that complies with ISO 27001 standards. The ISMS is audited and certified to ensure that the appropriate standards are fulfilled. The certification recognizes that all our products, operations, support processes and data storage protocols meet international security standards.

Reviews. We conduct thorough screenings and reviews of our systems, services and infrastructure taking into account security and compliance best practices, current risks, threats, vulnerabilities, technology, and changes in applicable legal requirements.

Trainings. Our staff has the obligation to secrecy in compliance with applicable law (§ 6 DSG) and undergoes regular training on data protection and confidentiality.

Trust Center. Learn more about our security measures in our Trust Center (https://www.storyblok.com/trust-center)

5. Personal Data We Process

5.1 Website

Our websites are made available to every internet user. We collect certain data when you visit our website and process data you, as a visitor, provide to us when accessing our website (storyblok.com).

Data we collect automatically from our website

Data you as our website visitor share directly with us

5.2 Customers

We collect and process following personal data when you are a customer of our Storyblok Services, interact with us and access the Storyblok Services via app.storyblok.com.

Data you as our website visitor share directly with us

Data we collect automatically from our Storyblok Services

5.3 Information we receive from other sources

We receive information about you from other Service users, from third party services, related companies, and from our business and channel partners. We process this data lawfully based on Article 6 (1) a, b and f GDPR.

Third Party Sources

5.4 Other Processing Activities

We may also process personal information when necessary for the following:

• The establishment, exercise, or defense of legal claims, whether in court, administrative, or other proceedings. (The legal basis for this processing is our legitimate interest in the protection and assertion of our legal rights, your legal rights, and the legal rights of others.)
• Obtaining or maintaining insurance coverage, managing risks, or obtaining professional advice (The legal basis for this processing is our legitimate interest in the proper protection of our business.)
• Compliance with applicable laws (The legal basis for this processing is compliance with a legal obligation applicable to Storyblok.)
• Compliance with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by authorities and cooperation with law enforcement agencies concerning conduct or activity that we, a service provider, or a third party reasonably and in good faith believe may violate applicable law (The legal basis for this processing is compliance with a legal obligation applicable to Storyblok.)
• Performing the tasks you have requested or to comply with your instructions or other contractual obligations between you and us;
• Processing based on our legitimate interests

5.5. How long do we keep your personal data?

5.5 How to access and control your information

You can exercise some of the choices by logging into the Storyblok Services and using settings available within the Storyblok Services or your account. Where the Storyblok Services are administered for you by an administrator (see “Notice to Users” below), you may need to contact your administrator to assist with your requests first. For all other requests, you may contact us as provided in the Section 3 above to request assistance.

You or an administrator can deactivate your access to a space. If you can deactivate your own access, that setting is available to you in the space settings. Otherwise, please contact your administrator. If you are an administrator and are unable to deactivate an account through your administrator settings, please contact Storyblok support. Please be aware that deactivating access to a space does not delete your information from that space; your added content remains visible to other Storyblok Service users based on your past participation within the Services. For example: if you have created a blog article in a specific space this blog article will still be available in that space.

5.6. Notice to Users

Our Storyblok Services are intended for both personal use and use by organizations. Where the Storyblok Services are made available to you through an organization (e.g. your employer), that organization is the administrator of the Storyblok Services.

Even if the Storyblok Services are not currently administered to you by an organization, if you are a member of a team administered by an organization, or if you use an email address provided by an organization (such as your work email address) to access the Storyblok Services, then the administrator of that team or the owner of the domain associated with your organizational email address (e.g. your employer) may assert administrative control over your account and use of the Storyblok Services at a later date. You will be notified if this happens.

Space administrators are able to restrict your access to and privileges within the respective space administrator controls. In some cases, enterprise administrators can also:

• require you to reset your account password;
• restrict, suspend or terminate your access to the Services or your account;
• control your ability to edit, restrict, modify or delete account information;
• change your account information, including profile information or the email address associated with your account;
• access information in and about your account;
• access or retain information stored as part of your account; and
• enable or disable apps, custom field types, third-party apps, or other integrations.

If you do not want an administrator to be able to assert control over your account or use of the Storyblok Services, you should deactivate your membership with the relevant space or remove any email addresses containing a domain owned or controlled by the administrator entirely from your account. Once an administrator asserts control over your account or use of the Storyblok Services, you may no longer be able to withdraw membership or change the email address associated with your account without administrator approval.

Please contact your organization or refer to your administrator’s organizational policies for more information.

You, your administrator or other Storyblok Service users may choose to add new functionality or change the behavior of the Storyblok Services by enabling third party Apps or Custom Field Types within the Storyblok Services. Doing so may give third-party apps access to your account and information about you like your name and email address, and any content you choose to use in connection with those apps. If you are an administrator or contact listed on an account, we share your details with the third-party app provider upon installation.

6. HOW WE SHARE DATA

6.1 Introduction

We do not sell, rent, or otherwise disclose your personal data for money or anything else of value.

However, we do work together with other companies, contractors and service providers who help us run our business and operate our Storyblok Services. These companies provide services to help us deliver the Storyblok Services to you, provide you with customer support, process credit card payments, manage and contact you and other (potential) customers, provide marketing support, and otherwise improve our products and services.

6.2 Sharing and Disclosing of Personal Data

We may share your personal data with following categories of third parties:

6.3. Service Providers

We share personal data with our service providers that help us to administer and provide the Storyblok Services; support our provision of products and services; send communications; provide technical support; and assist with other legitimate purposes.

We require all our service providers to undergo a thorough diligence process by our team to ensure that your data is adequately protected. This process includes a review of the data we plan to share with the service provider and the associated level of risk, the service provider’s security policies, measures, certifications and third party audits, and whether the service provider has a mature privacy program in place that respects the rights of data subjects.

Some of the service providers process your personal data, or have their seat, outside the European Economic Area. We may transfer your personal data outside the EEA on the condition that all appropriate safeguards required by applicable data laws are in place. We take care to ensure our partners regardless of location have sufficient safeguards in place to process and protect your personal data in line with our own data protection and information security standards.

Services we use to operate & provide the Storyblok Services

*As Enterprise Plus Customer you may opt-out from data being transferred to this service provider within the Storyblok Service (app.storyblok.com).

Services we use in connection with our website/app

Services we use to support our business operations

7. YOUR RIGHTS

7.1 Your Rights

In accordance with the provisions of the GDPR, you as a data subject may assert the following data protection rights against us, where we are controller:

• Right to withdraw consent: You may revoke the consent you have given to us at any time (Art. 7 (3) GDPR). This has the consequence that we will no longer carry out the data processing covered by this consent in the future. Revoking your consent will not affect the lawfulness of processing based on consent before the withdrawal.
• Right of access (Art. 15 GDPR): You have the right to obtain information whether or not your data is processed, and, where that is the case, access to the personal data and information in compliance with Article 15 GDPR.
• Right to rectification (Art. 16 GDPR): You have the right to request that the data we hold about you be corrected if it is inaccurate or incomplete.
• Right to erasure (“right to be forgotten”, Art. 17 GDPR): You have the right to request the deletion of the data we hold about you without undue delay, unless other statutory provisions (e.g. statutory retention obligations) prevent this or there is an overriding interest on our part (e.g. to defend our rights and claims).
• Right to restriction of processing (Art. 18 GDPR): You may request us to (temporarily) restrict the processing of your data in accordance with Art. 18 GDPR, for example when the personal data we hold about you may be inaccurate or unnecessary.
• Right to data portability (Art. 20 GDPR): You have the right to receive your data, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a different controller without hindrance from us. Prerequisite is, that we process your data either based on consent (Article 6 (1) (a) or Article 9 (2) (a) GDPR) or based on a contract (Article 6 (1) (b) GDPR) and the processing is carried out by automated means.
• Right to object (Art. 21 GDPR): You have the right to object, on grounds relating to your particular situation, at any time to processing of your data which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. Please tell us your exact reasons why we should stop processing your data. We will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims. We will no longer process your data for direct marketing purposes when you object to processing.
• Right of complaint: If you believe that processing your data violates data protection laws, you have the right to file a complaint with a supervisory authority. Without prejudice to any other administrative or judicial remedy, you have the right to complain in the member state of your habitual residence, place of work or place of the alleged infringement.

If you would like to register your complaint with the Austrian supervisory authority, please send your claim to:

Österreichische Datenschutzbehörde

Barichgasse 40 - 42

1030 Vienna, Austria

+43 1 52 152-0

dsb@dsb.gv.at

7.2 How you can assert your rights

You can assert your rights personally, in written form as follows:

Storyblok GmbH

Ing. Dominik Angerer

Peter-Behrens-Platz 2

4020 Linz, Austria

E-Mail: legal@storyblok.com

Please be informed that we will only provide you with information if you identify yourself.

8. Miscellaneous

Links to other Websites. Our Privacy Policy also links to websites of third parties. We have no control over the content, or the data protection practices, of these websites. We recommend reading the data protection policies of any websites of third parties visited.

Changes to this Privacy Policy. We may change this privacy policy from time to time. We will post any privacy policy changes on this page and, if the changes are significant, we will provide a more prominent notice by adding a notice on the Storyblok Services homepages, login screens, or by sending you an email notification. We will also keep prior versions of this Privacy Policy in an archive for your review. We will obtain your consent for any changes or adjustments to this privacy statement that can only be implemented with your consent as a data subject.

Handling Disputes. If there ever should be any concern or dispute relating to our data protection practices, we hope to be able to resolve such disputes between us in an amicable and mutually beneficial way. If you have a concern or dispute with us, you can raise your concern or dispute by contacting us either via email or by mail at the following address:

Storyblok GmbH

Ing. Dominik Angerer

Peter-Behrens-Platz 2

4020 Linz, Austria

E-Mail: legal@storyblok.com

If you are a visitor to our website you have the right to commence proceedings in a court of competent jurisdiction in accordance with applicable data protection laws.

If you are our Customer and entered into our Terms, please see the relevant section on applicable law and jurisdiction of our Terms, which describes how disputes will be resolved between us.