Privacy Notice

1. Controllers

The joint controllers for this website are:

Controllers

Eric GergelyAnouk HardeMarkus Müller

Address

c/o Anouk HardeMaximilianstraße 4380538 MunichGermany

Email

privacy@narrivastories.com

Website operation and security

The named joint controllers are responsible for this. We use Cloudflare Pages and Cloudflare security services for the technical provision and protection of the website.

Waitlist and email updates

The named joint controllers are responsible for this. We use Brevo for signup management and email delivery.

Processor contracts

The named joint controllers conclude and maintain required processor contracts

Privacy requests

privacy@narrivastories.com

The persons named above jointly determine the purposes and means of processing personal data in connection with this website. The list above summarizes the essence of their joint-controller arrangement.

The contact email address above is the central point of contact for privacy requests. Data subjects may exercise their rights against any of the named controllers regardless of this point of contact.

2. Purpose of this website

This website presents the Narriva Stories project, provides information about its development, and offers the option to sign up for email updates about the project.

We process personal data only to the extent required to operate the website, provide its content, handle requests, manage signups for email updates, or protect legitimate interests.

3. Website access and hosting

Our website is provided through Cloudflare Pages. The provider is Cloudflare, Inc. or its affiliated companies.

When the website is accessed, technically necessary data is processed so the website can be delivered to the browser on the relevant device. This may include, in particular:

• IP address
• date and time of access
• requested URL
• referrer information
• browser and device information
• operating system
• transferred data volume
• technical status and security information

Processing is carried out for the technical provision, stability, security, and optimization of the website.

The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure, stable, and efficient operation of the website.

Cloudflare may also process data outside the European Union or the European Economic Area. We use Cloudflare on the basis of suitable data protection agreements, in particular a data processing agreement and, where required, appropriate safeguards for third-country transfers.

4. Cloudflare Web Analytics

We use Cloudflare Web Analytics to statistically evaluate the use of our website. We receive aggregated information about how the website is used, for example:

• visited pages and paths
• number of page views
• country of origin
• referrer
• device type
• browser
• operating system

We use this information to understand which language versions and content are used and to improve the website.

According to Cloudflare, Cloudflare Web Analytics does not use cookies, localStorage, or fingerprinting for analytics purposes.

The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in privacy-friendly, aggregated analytics and the improvement of our website.

5. Signup for email updates / waitlist

Our website offers the option to sign up with an email address for updates about the Narriva Stories project.

In this context, we process in particular:

• email address
• selected consent language, such as English or German
• time of signup
• signup source and page path
• consent version and privacy notice version
• technical proof data for signup, where required

Signup takes place on the basis of explicit consent. Consent is given by actively selecting the corresponding checkbox and submitting the form.

Processing is carried out for the purpose of sending email updates about Narriva Stories and documenting consent.

The legal basis for sending email updates is Art. 6 para. 1 lit. a GDPR. The legal basis for documenting consent is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in being able to prove a lawful signup.

We use Brevo to manage email signups and send emails. The provider is Sendinblue SAS / Brevo, France.

Email addresses are not stored permanently in a separate Cloudflare database, but are transferred to Brevo and managed there. Brevo processes the data on our behalf.

Every email contains an unsubscribe option. Consent can be withdrawn at any time with effect for the future, for example via the unsubscribe link in each email or by sending a message to privacy@narrivastories.com.

After unsubscribing, the data will no longer be used to send email updates. Proof data regarding consent may remain stored where this is necessary to document the lawfulness of the original signup or to defend legal claims.

6. Contacting us

If you contact us by email or through the contact form, we process the data you send to us, in particular:

• name, if provided
• email address
• message content
• locale or language version
• subject
• time of contact
• technical metadata, such as referrer and user agent, where applicable
• other voluntarily provided information

Processing is carried out to handle the request and communicate with you.

The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in handling and responding to requests. If the request is aimed at entering into or performing a contract, Art. 6 para. 1 lit. b GDPR is an additional legal basis.

If the website uses a link that opens the user's email program, clicking that link alone does not send any content to us. Data is transmitted to us only when the email is actually sent.

Contact requests are deleted once the request is resolved, plus reasonable retention where this is legally necessary, for example because statutory retention obligations apply or because the data is needed to establish, exercise, or defend legal claims.

7. Cookies and similar technologies

In the current configuration, we do not use analytics or marketing cookies.

According to Cloudflare, Cloudflare Web Analytics does not use cookies, localStorage, or fingerprinting for analytics purposes.

The website uses the browser sessionStorage key narriva.entryLoaderSeen only to remember during the current browser session that the entry loader has already been shown. This is not used for tracking, analytics, or marketing and is deleted when the browser session ends.

If we use cookies or comparable technologies in the future that are not technically necessary, we will update this privacy notice accordingly and, where required, obtain prior consent.

8. Recipients and processors

Personal data may be transferred to service providers that support us in operating the website and managing email signups.

This concerns in particular:

• Cloudflare for hosting, security functions, and Web Analytics
• Brevo for email signups, contact management, and email delivery

These service providers process personal data on our behalf where necessary. We enter into data processing agreements where required.

Personal data is not disclosed to third parties for advertising purposes and is not sold.

9. Retention period

We store personal data only for as long as required for the respective purposes.

• technical access and log data: only as long as needed for security, error analysis, and operation
• email signups and waitlist data: until unsubscribe or withdrawal of consent
• proof data regarding consent: for as long as needed to prove consent or defend legal claims
• contact requests: until the request is resolved, plus reasonable retention if legally necessary

10. Data subject rights

Data subjects have, in accordance with the GDPR, in particular the following rights:

• right of access
• right to rectification
• right to erasure
• right to restriction of processing
• right to data portability
• right to object to processing based on legitimate interests
• right to withdraw consent with effect for the future

To exercise these rights, a message is sufficient to

privacy@narrivastories.com

11. Right to lodge a complaint

Data subjects have the right to lodge a complaint with a data protection supervisory authority if they believe that the processing of personal data violates data protection law.

The competent supervisory authority may in particular be the authority in the EU member state of the data subject's habitual residence, workplace, or place of the alleged infringement.

12. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Changes to this privacy notice

We may update this privacy notice if the website, the services used, or the legal requirements change. The version published on this website applies.