Data Protection Policy

<!doctype html> <html class="no-js" lang="en" data-vp-page-id="394801381421" data-vp-page-template="article"> <head>   <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="repository-base-url" content="../home"> <meta name="source-last-modified" content="2023-04-14T08:51Z"> <meta name="Help Center Version" content="1.4"> <link rel="icon" href="https://docs.storyteq.com/__assets-7375bbea-cbb4-42bd-8052-aec5fb125808/image/teq_favicon-big2.png"> <link rel="apple-touch-icon" href="https://docs.storyteq.com/__assets-7375bbea-cbb4-42bd-8052-aec5fb125808/image/teq_favicon-big2.png"> <link rel="canonical" href="https://docs.storyteq.com/home/data-policy"> <link rel="alternate" hreflang="en" href="https://docs.storyteq.com/home/data-policy"> <link rel="alternate" hreflang="x-default" href="https://docs.storyteq.com/home/data-policy">   <meta name="title" content="Data Protection Policy"> <meta name="description" content="13th April 2023 1. Introduction Storyteq needs to collect and use certain types of information when using its software, this may include client emp..."> <meta property="og:description" content="13th April 2023 1. Introduction Storyteq needs to collect and use certain types of information when using its software, this may include client emp..."> <meta property="twitter:description" content="13th April 2023 1. Introduction Storyteq needs to collect and use certain types of information when using its software, this may include client emp...">  <meta property="og:type" content="website"> <meta property="og:url" content="https://docs.storyteq.com/home/data-policy"> <meta property="og:title" content="Data Protection Policy"> <meta property="og:image" content="https://docs.storyteq.com/__assets-7375bbea-cbb4-42bd-8052-aec5fb125808/image/docs_new.png">  <meta property="twitter:card" content="summary_large_image"> <meta property="twitter:title" content="Data Protection Policy"> <meta property="twitter:image" content="https://docs.storyteq.com/__assets-7375bbea-cbb4-42bd-8052-aec5fb125808/image/docs_new.png"> <script> var hasCookieNotice = false; var usesCookieOptInStrategy = true; var cookieRelatedFeatures = []; function isSitePreview() { var previewStagingUrlMatcher = /\/~preview-([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})\//; return previewStagingUrlMatcher.test(window.location.href); } function hasSiteViewerGivenConsentForTracking() { try { return window.localStorage.getItem('shc-cookies') === 'enabled'; } catch (e) { return false; } } function hasSiteViewerRefusedConsentForTracking() { try { return window.localStorage.getItem('shc-cookies') === 'disabled'; } catch (e) { return false; } } function areCookiesEnabled() { if (!hasCookieNotice) { return true; } if (usesCookieOptInStrategy) { if (hasSiteViewerGivenConsentForTracking()) { return true; } } else { if (!hasSiteViewerRefusedConsentForTracking()) { return true; } } return false; } var registerCookieRelatedFeature = function (featureFunction) { if (typeof featureFunction === 'function') { cookieRelatedFeatures.push(featureFunction); } } var initializeCookieRelatedFeatures = function () { if (!areCookiesEnabled()) { return; } window.scrollHelpCenter.areCookiesEnabled = true; for (const cookieRelatedFeature of cookieRelatedFeatures) { try { cookieRelatedFeature(); } catch (e) { console.error(e); } } } window.scrollHelpCenter = { collection: JSON.parse('{\"members\":[{\"name\":\"Storyteq Docs\",\"prefix\":\"home\"}],\"currentContentSource\":{\"name\":\"Storyteq Docs\",\"prefix\":\"home\"}}'), source: { confluenceBaseUrl: 'https://storyteq.atlassian.net/wiki', confluencePageId: '394801381421', confluenceSpaceKey: 'SD', }, contentSourceKey: 'SPACE:SD', siteKey: 'a2b009e9-d044-426e-ac7b-4a5d2ad6d38f', customJsSrc: '../__assets-7375bbea-cbb4-42bd-8052-aec5fb125808/js/custom.js', isSitePreview: isSitePreview(), areCookiesEnabled: areCookiesEnabled(), excludePageLabel: 'scroll-help-center-exclude-page', hasCookieNotice: hasCookieNotice, usesCookieOptInStrategy: usesCookieOptInStrategy, registerCookieRelatedFeature: registerCookieRelatedFeature, initializeCookieRelatedFeatures: initializeCookieRelatedFeatures, isPortal: false, isSearch: false, isError: false, isOverview: false, viewportLink: '../home/', relSiteRootPath: '../', siteInstanceId: '7375bbea-cbb4-42bd-8052-aec5fb125808', theme: { root: { absoluteLink: '../home/' }, header: { displaySpaceName: false, links: JSON.parse('[{\"url\":\"https:\/\/storyteq.com\/\",\"text\":\"Storyteq website\"}]'), logo: { url: '../__assets-7375bbea-cbb4-42bd-8052-aec5fb125808/image/docs_new.png', alt: 'Storyteq Docs' }, }, cookieNotice: { display: false, headingText: 'Cookie Notice', descriptionText: 'Please read our privacy statement.', link: { url: '', text: '' } } }, integrations: { jiraServiceDesk: { key: '' }, intercom: { appId: '' }, zendesk: { url: '' }, aiSearch: { enabled: false } }, repository: { link: '../home', name: 'Storyteq Docs' }, versionLinksForPage: JSON.parse('null'), variantLinksForPage: JSON.parse('null'), languageLinksForPage: JSON.parse('[{\"displayName\":\"English\",\"code\":\"en\",\"toLanguageLink\":\"..\/home\/data-policy\",\"fallback\":false}]'), defaultLanguageCode: 'en' }; </script>  <script> window.scrollHelpCenter.registerCookieRelatedFeature(function () { if (!window.scrollHelpCenter.isSitePreview) { (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-TP9VPWP'); } }); </script>  <link rel="stylesheet" href="../__theme/css/app--b6a416c0af4cf77d3f2c.css"> <link rel="stylesheet" id="theme-asset-custom-css" href="../__assets-7375bbea-cbb4-42bd-8052-aec5fb125808/css/custom.css"> <style> :root { --_vpt-INTERNAL-footer-background: #222; --_vpt-INTERNAL-footer-foreground: #FFF; --_vpt-INTERNAL-header-background: #ffffff; --_vpt-INTERNAL-header-foreground: #222222; /* @deprecated */ --vp-portal-banner-background-image: url('../header-background--b27bdbd2502a69f032bd.jpg'); /* @deprecated */ --vp-portal-banner-text-color: #FFF; /* @deprecated */ --vp-space-banner-background-image: url('../header-background--b27bdbd2502a69f032bd.jpg'); /* @deprecated */ --vp-space-banner-text-color: #FFF; } </style> <title>Data Protection Policy</title> </head>  <body pageid="394801381421" class="flex flex-col min-h-screen"> <div id="vp-js-cookies__notice"></div> <vp-a11y-skip-controller> <a class="vp-a11y-skip-trigger" href="#content"> <i18n-message i18nkey="navigation.skip.to.main.label"> Skip to main content </i18n-message> </a> </vp-a11y-skip-controller> <button type="button" class="vp-a11y-skip-trigger vp-js-a11y-navigation-toggle"> <i18n-message i18nkey="navigation.open.label"> Show navigation </i18n-message> </button> <header data-vp-component="header" class="header hc-header-background-color"> <div class="header__navigation relative"> <div class="hc-header-background-color relative z-10" id="site-navigation"> <div class="top-bar header__navigation--large vp-container hc-header-background-color hc-header-font-color"> <div class="top-bar-left"> <ul class="flex flex-wrap flex-row gap-4 items-center relative m-0 p-0 list-none hc-header-background-color"> <li class="leading-none align-self-center header__navigation--logo"> <vp-localized-link> <a href="../home/"> <img src="../__assets-7375bbea-cbb4-42bd-8052-aec5fb125808/image/docs_new.png" alt=""> <i18n-message class="sr-only" i18nKey="header.home.label"> Go to homepage </i18n-message> </a> </vp-localized-link> </li> </ul> </div> <div class="top-bar-right no-print"> <div class="header__navigation--large__menu hc-header-background-color"> <ul class="flex flex-row m-0 p-0 list-none render-links"> <li class="order-6 lg:order-2 render-links--link render-links--link--border"> <a href="https://storyteq.com/" class="block px-4 py-3 hc-header-font-color" rel="noopener"> Storyteq website </a> </li> </ul> <div class="my-auto list-none ml-4"> <div data-vp-id="search-bar-placeholder" data-vp-component="search-bar" data-vp-variant="" class="vp-search-bar " aria-hidden="true" > <form action="/search.html" method="GET" class="vp-search-bar__input-container" > <div data-vp-component="search-input" data-vp-variant="border" class="vp-search-input vp-search-input--border" > <input type="search" autocomplete="off" value="" class="vp-search-input__input" style="margin-right: 0;" > </div> </form> </div> <script data-vp-id="search-bar-config" type="application/json"> { "hasContentSourceFilter": false, "hasQuickSearch": true, "variant": "" } </script> </div> </div> <button type="button" class="vp-js-header-search-toggle vp-button header__navigation--button hc-header-font-color"> <svg data-vp-id="header-search-toggle-icon" data-vp-component="icon" xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 20 20" fill="none" aria-hidden="true" > <path d="M8.99452 14.5C10.5121 14.5 11.809 13.9669 12.8854 12.9007C13.9618 11.8345 14.5 10.5361 14.5 9.00548C14.5 7.48794 13.9631 6.19097 12.8893 5.11458C11.8155 4.03819 10.519 3.5 9 3.5C7.46786 3.5 6.16816 4.0369 5.1009 5.11071C4.03363 6.18453 3.5 7.48096 3.5 9C3.5 10.5321 4.0331 11.8318 5.09929 12.8991C6.1655 13.9664 7.46391 14.5 8.99452 14.5ZM9 16C8.02913 16 7.11974 15.816 6.27185 15.4479C5.42395 15.0799 4.68056 14.5799 4.04167 13.9479C3.40278 13.316 2.90278 12.576 2.54167 11.728C2.18056 10.88 2 9.97053 2 8.99956C2 8.04152 2.18403 7.13542 2.55208 6.28125C2.92014 5.42708 3.41864 4.68387 4.04758 4.0516C4.67653 3.41935 5.41569 2.91935 6.26508 2.5516C7.11449 2.18387 8.02548 2 8.99806 2C9.95769 2 10.8646 2.18403 11.7188 2.55208C12.5729 2.92014 13.316 3.42014 13.9479 4.05208C14.5799 4.68403 15.0799 5.42612 15.4479 6.27835C15.816 7.13058 16 8.0381 16 9.00094C16 9.83365 15.8615 10.6213 15.5846 11.3638C15.3078 12.1062 14.9254 12.7836 14.4375 13.3958L18 16.9583L16.9375 18L13.375 14.4583C12.7668 14.9459 12.0939 15.3247 11.3564 15.5948C10.6188 15.8649 9.83333 16 9 16Z" fill="currentColor"></path> </svg> <i18n-message class="sr-only" i18nKey="search.form.show.label"></i18n-message> </button> </div> </div> </div> </div> </header> <div class="flex flex-col flex-grow hc-main-wrapper"> <div class="vp-article vp-container article"> <div class="vp-article__aside-left no-print"> <div id="vp-js-desktop__navigation" class="vp-article__aside-left__inner"></div> </div> <main id="article-content" class="vp-article__content-panel"> <i18n-message i18nkey="breadcrumb.label" attribute="aria-label" class="vp-breadcrumbs__wrapper"> <nav class="vp-breadcrumbs" aria-label="Breadcrumb" role="navigation"> <div class="breadcrumbs-wrapper"> <ol class="breadcrumbs breadcrumbs--fit-content"> <li> <a href="../home/" rel="prev">Storyteq Docs</a> <span aria-hidden="true">/</span> </li> <li> <a href="../home/data-legal" rel="prev" class="js-breadcrumbs-truncate">Data & Legal</a> </li> </ol> </div> </nav> </i18n-message> <div id="content" class="vp-a11y-skip-target" tabindex="-1"></div> <div class="vp-article__aside-right no-print"> <vp-toc data-vp-component="toc" for="main-content"> <vp-a11y-skip-controller slot="afterbegin"> <a class="vp-a11y-skip-trigger" href="#article-inner-content"> <i18n-message i18nkey="navigation.skip.toc.label"> Skip table of contents </i18n-message> </a> </vp-a11y-skip-controller> </vp-toc> </div> <div id="article-inner-content" class="vp-article__wrapper" tabindex="-1"> <header class="article-header">  <h1 class="vp-article__heading article__heading"><span>Data Protection Policy</span></h1> </header> <section id="main-content" class="vp-article__content wiki-content article__content"> <p><em>13<sup>th</sup> April 2023</em></p><h3 id="DataProtectionPolicy-1.Introduction"><strong>1. Introduction</strong></h3><p>Storyteq needs to collect and use certain types of information when using its software, this may include client employee contact information and that of their customers. It may also be required by law to collect and use certain types of information to comply with statutory obligations of Local Authorities, government agencies and other bodies.</p><p>This personal information must be dealt with properly, no matter how it is collected, recorded, and used whether on paper, IT-based, or recorded on other material. Safeguards must be in place to ensure all activity complies with the applicable data protection legislation.</p><p>Storyteq regards the lawful and correct treatment of personal information as vital to successful operations and is committed to maintaining confidence between our company and those with whom we have dealings. Storyteq ensures the organisation treats personal information lawfully and correctly.</p><p>Most businesses hold personal data on their customers, employees, and partners. The increase in the use of the internet, electronic communication and computerisation of business data has led to an increase in the importance of privacy. Breaches of computerized data security have prompted the introduction of legislation on a national and European level.</p><p>These include:</p><ul><li><p>Human Rights Act 1998.</p></li><li><p>Freedom of Information Act 2000.</p></li><li><p>Privacy and Electronic Communications Regulations 2003.</p></li><li><p>Regulation of Investigatory Powers Act 2000.</p></li><li><p>Telecommunications (Lawful Business Practice) Interception of Communications.</p></li><li><p>Regulations 2000.</p></li><li><p>General Data Protection Regulation.</p></li><li><p>Computer Misuse Act 1990.</p></li></ul><p>As Storyteq is an international organisation other legislation must also be considered and factored into any data processing activity. More detail on the relevant legislation can be found in the Legal and Regulatory Policy, that can be obtained by request from <a shape="rect" href="mailto:DataProtection@teamitg.com" class="external-link" rel="nofollow">DataProtection@teamitg.com</a>.</p><hr><h3 id="DataProtectionPolicy-2.HowStoryteqwillmanageDataProtection"><strong>2. How Storyteq will manage Data Protection</strong></h3><p>Storyteq will, through appropriate management, strict application of criteria and controls:</p><ul><li><p>Observe fully the conditions regarding the fair collection and use of information.</p></li><li><p>Meet its legal obligations to specify the purposes for which information is used.</p></li><li><p>Collect and process appropriate information, and only to the extent that it is needed to fulfil operational needs or to comply with any legal requirements.</p></li><li><p>Ensure the quality of information used.</p></li><li><p>Apply strict checks to determine the length of time information is held, this will be dictated in specific Data Processing Agreements.</p></li><li><p>Ensure that the rights of people about whom information is held can be fully exercised under the DPA 18 and GDPR. This is detailed in 4.4 under subject access.</p></li><li><p>Take appropriate technical and organisational security measures to safeguard personal information.</p></li><li><p>Provide individuals that request it, within a maximum of 30 days from request, access to personal information held about them for no initial fee. Should the data subject require more detailed information that is beyond the reasonable access requirements, then an administration fee may be added.</p></li><li><p>Correct or erase any information on an individual that is inaccurate or misleading, as per 4.4.</p></li><li><p>Not use information for a purpose that is incompatible with the original purpose for which permission was given by the data subject.</p></li><li><p>Obtain clear, express permission for handling and using 'sensitive' personal data, such as race, ethnicity, political opinions, religious beliefs, trade union membership, state of health (both physical and mental), sexual orientation, criminal convictions and sentences and allegations of criminal behaviour.</p></li><li><p>Treat people justly and fairly whatever their age, religion, disability, gender, sexual orientation or ethnicity when dealing with requests for information.</p></li><li><p>Set out clear procedures for responding to requests for information.</p></li><li><p>Allocate such resources as may be required to ensure the effective operation of the policy.</p></li><li><p>All data breaches will be fully investigated and reported to the relevant authority within 72 Hours.</p></li><li><p>Data Privacy Impact Assessments will be carried out on all medium/high risk processes that may affect the rights and freedoms of individuals.</p></li></ul><p>In addition, Storyteq ensures that:</p><ul><li><p>There is someone with specific responsibility for Data Protection within the group.</p></li><li><p>Everyone managing and handling personal information understands they are contractually responsible for following good data protection practice.</p></li><li><p>Everyone managing and handling personal information is appropriately trained to do so and supervised.</p></li><li><p>Anybody wanting to make enquiries about handling personal information knows what to do.</p></li><li><p>Queries about handling personal information are promptly and courteously dealt with.</p></li><li><p>Methods of handling personal information are clearly described.</p></li><li><p>A regular review and audit are made of the way personal information is held, managed and used.</p></li><li><p>Methods of handling personal information are regularly assessed and evaluated.</p></li><li><p>Performance in handling personal information is regularly assessed and evaluated.</p></li><li><p>A breach of the rules and procedures identified in this policy may lead to disciplinary action being taken against the members of staff concerned.</p></li></ul><hr><h3 id="DataProtectionPolicy-3.GeneralDataProtectionRegulation(GDPR)andDataProtectionAct2018(DPA18)"><strong>3. General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA 18)</strong></h3><p>On 25 May 2018, the GDPR and DPA 18 came into effect in the UK; both cover data protection in the UK and must be read side by side. The main differences, according to the Information Commissioner's Office (ICO) are that: The GDPR has direct effect across all EU member states and has already been passed. This means organisations will still have to comply with this regulation and we will still have to look to the GDPR for most legal obligations. However, the GDPR gives member states limited opportunities to make provisions for how it applies in their country; from the 1st of Jan 21, the UK will write EU GDPR into UK legislation, it will be known as the UK GDPR and carry the same controls.</p><p>The UK, as of the 28th of June 2021, has an approved adequacy with the EU meaning the UK GDPR provides an adequate level of data protection controls to allow data to freely flow between the UK and EU.</p><p>Storyteq has offices in both the EU and the UK and ensures that the same controls are in place to make sure data subjects rights are fully protected under the UK GDPR (UK DPA 18) and EU GDPR.</p><h4 id="DataProtectionPolicy-3.1Guidingprinciplesofdataprotection"><strong>3.1 Guiding principles of data protection</strong></h4><p>Below are the seven guiding principles of the GDPR and DPA 18. These are the foundations to processing personal data:</p><ul><li><p>Lawfulness, fairness and transparency</p></li><li><p>Purpose limitation</p></li><li><p>Data minimisation</p></li><li><p>Accuracy</p></li><li><p>Storage limitation</p></li><li><p>Integrity and confidentiality (security)</p></li><li><p>Accountability</p></li></ul><p>These principles lie at the heart of our approach to processing personal data.</p><h4 id="DataProtectionPolicy-3.2HowStoryteqaddressesDPA18andGDPR"><strong>3.2 How Storyteq addresses DPA 18 and GDPR</strong></h4><p> Storyteq conducts the following controls in line with the GDPR and DPA 18 on all accounts that process personal data:</p><ul><li><p><strong>Data Flow Mapping</strong> – this is used to understand all the data touchpoints and where data moves from one system to another.</p></li><li><p><strong>Subject Access Requests</strong> – this includes all other data subject rights and how they will be answered.</p></li><li><p><strong>Data Processing Agreements</strong> – this document details how data will be processed for the data controller. It is clear and simple and allows all parties to know their responsibility.</p></li><li><p><strong>Data Privacy Impact Assessments</strong> – These assessments are used to identify and manage any associated data management risk</p></li><li><p><strong>Breach Procedure</strong> – The reporting of any confirmed data breach, either to the data controller or, if ITG is the data controller, an assessment to whether the breach needs to be reported to the ICO, within the statutory 72 hours.</p></li></ul><p>These controls will be developed and changed in line with data protection legislation and any new guidance from the ICO.</p><hr><h3 id="DataProtectionPolicy-4.Guidingprinciples"><strong>4. Guiding principles</strong></h3><h4 id="DataProtectionPolicy-4.1Fairobtainingandprocessing"><strong>4.1 Fair obtaining and processing</strong></h4><p>Storyteq will ensure that, as far as practicable, all individuals whose details are processed by Storyteq are aware of the way in which that information will be obtained, held, used and disclosed. Whenever possible, individuals will be informed of the potential recipients of the information. Processing of personal information by Storyteq will be fair and lawful and, in addition, it is ITG’s policy that individuals will not be misled regarding the purposes to which Storyteq will process the information.</p><h4 id="DataProtectionPolicy-4.2Notification"><strong>4.2 Notification</strong></h4><p>Storyteq will not use or process personal information in any way that contravenes its notified purposes, or in any way that would constitute a breach of the GDPR. When appropriate, Storyteq v will notify the</p><p>Information Commissioner of any amendments to the existing Storyteq policy, or of new purposes to be added to the Notification Register entry.</p><h4 id="DataProtectionPolicy-4.3Informationqualityandintegrity"><strong>4.3 Information quality and integrity</strong></h4><p>Storyteq will endeavor to process personal information that is accurate, current and is of good quality. Information obtained by Storyteq will be adequate and not excessive for the purpose for which it is processed. In addition, information will be kept by Storyteq for no longer than is necessary for the purpose or purposes for which it was obtained.</p><p>All retention and data types held will be detailed in Data Processing Agreements with all data controllers. Where Storyteq is the data controller, the Storyteq Privacy Policy will apply.</p><h4 id="DataProtectionPolicy-4.4Subjectaccess"><strong>4.4 Subject access</strong></h4><p>Storyteq will respond positively to subject access requests, replying as quickly as possible, and in any event within the 30-day time limit. Whereas individuals have a general right of access to any of their own personal information that is held, Storyteq will be mindful of those circumstances where an exemption may apply.</p><p>Storyteq will only disclose personal data to those recipients listed in the Notification Register, or whenever it is otherwise permitted by law to do so. Storyteq will always endeavor to seek the permission of the data subject where it is required by law to do so.</p><p>Under GDPR the following data subject rights apply and will be managed throughout by the group DPO:</p><ul><li><p>The right to be informed</p></li><li><p>The right of access</p></li><li><p>The right to rectification</p></li><li><p>The right to erasure</p></li><li><p>The right to restrict processing</p></li><li><p>The right to data portability</p></li><li><p>The right to object</p></li><li><p>Rights in relation to automated decision-making and profiling</p></li></ul><h4 id="DataProtectionPolicy-4.5Technicalandorganisationalsecurity"><strong>4.5 Technical and organisational security</strong></h4><p>Storyteq has in place appropriate security measures as required by the Data Protection Act. Information systems are installed with adequate security controls, and company employees who use these systems will be properly authorised to use them for company business.</p><h4 id="DataProtectionPolicy-4.6Computermisuse"><strong>4.6 Computer misuse</strong></h4><p>The Computer Misuse Act 1990 makes it an offence to gain unauthorised access to a computer, even if no damage is done and no files are deleted or changed. Anyone who accesses a computer without authorisation, for example by guessing a password, faces a maximum six-month prison sentence, a maximum fine of £2,000, or both.</p><p>If an individual gains unauthorised access with the intent to commit a further offence, for example accessing a bank account online to transfer money, they face five years' imprisonment and/or a fine.</p><p>This Act also makes it an offence to purposefully change files on a computer with intent and without authorisation. This could include deleting files or even changing computer settings. Anyone who does so, even if there is no intent to defraud or do damage, faces a maximum prison sentence of five years and/or an unlimited fine.</p><h4 id="DataProtectionPolicy-4.7Controllingaccess"><strong>4.7 Controlling access</strong></h4><p>Storyteq has tightened physical access to data by restricting it to employees needing to access specific data in order to carry out their jobs. Storyteq takes steps to prevent accidental loss or theft of personal data by using server backup processes and increased security at our offices.</p><h4 id="DataProtectionPolicy-4.8TransferofData"><strong>4.8 Transfer of Data</strong></h4><p>All data transfer must be via secure means in line with the Storyteq /ITG Group Cryptography policy and in line with sub-processors detailed and applicable data protection legislation.</p><p>The Schrems II decision has also changed the way EU data can be transferred to the US, this can no longer be done under the protection of the EU-US Privacy shield.</p><p>The Schrems II Decision is a key ruling by the Court of Justice of the European Union (CJEU), in July 2020 they declared that Privacy Shield, the EU-US personal data transfer mechanism, was no longer lawful. The Schrems II decision specifically looked at Privacy Shield and standard contractual clauses (SCCs).</p><p>Any transfer of EU citizens data outside of the EU must have binding corporate rules or standard contractual clauses in place to ensure data protection compliance. The data controller must also have approved any such transfer in line with any Data Processing Agreements (DPA) and Data Privacy Impact Assessment (DPIA) findings and recommendations.</p><p>As the UK left the EU before June 2021 it did not implement the new EU SCC’s; for transfers from the UK to non-adequate third countries (mostly countries not in the EEA), the ICO has released the International Data Transfer Agreement (IDTA) and <a shape="rect" href="https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/ico-consultation-on-data-transferred-outside-of-the-uk/" class="external-link" rel="nofollow">draft guidance on transfer risk assessments</a>.</p><p>The IDTA is considered to be a replacement of former SCCs and facilitates transfers from the UK to non-adequate third countries.</p><p>Storyteq will replace any current transfer agreements under the old EU SCC’s by Sept 22 and either replace them with the new EU SCC’s or UK IDTA, depending what is applicable.</p><h4 id="DataProtectionPolicy-4.9Sub-processorsandcompliance"><strong>4.9 Sub-processors and compliance</strong></h4><p>All sub-processors of personal data are subject to compliance with the applicable data protection legislation associated to the data subject’s location and/or client requirements, in line with any DPA or MSA agreements.</p><p>Systems are hosted in Google Cloud Platform (GCP), normally hosted within the EU, unless specifically requested for alternative hosting location within client agreements. Any integrations that may process personal data is fully GDPR compliant in line with this Agreement.</p><p>If you require any further information on sub-processors or hosting locations, please contact the ITG Group DPO – <a shape="rect" href="mailto:DataProtection@teamitg.com" class="external-link" rel="nofollow">DataProtection@teamitg.com</a>.</p><hr><h3 id="DataProtectionPolicy-5.InternationalDataProtectionLegislation"><strong>5. International Data Protection Legislation</strong></h3><p>As an international organisation offering a range of marketing activities, Storyteq must consider international data protection legislation. As GDPR is currently the most stringent of these legislations, Storyteq tries to ensure all data processing is done in line with GDPR, where this is not possible, other relevant legislation types are risk assessed and the required controls applied.</p><p>Any transfer or processing must be fully risk assessed by the group DPO to ensure the correct protection is given to the data processing activity.</p><h4 id="DataProtectionPolicy-5.1USDataProtection"><strong>5.1 US Data Protection</strong></h4><p>Storyteq and ITG Group has 2 offices in the US, Chicago and New York. The main federal legislation is the CAN-SPAM, as federal law it covers all states and requires the following compliance:</p><ul><li><p>Make sure you have a way to collect and manage opt-outs.</p></li><li><p>And make sure your emailing partners are honouring opt-outs too</p></li><li><p>Check your unsubscribe link.</p></li><li><p>Is your mailing address correct?</p></li><li><p>Evaluate your email content.</p></li></ul><p>The focus of the law is to reduce spam and allow data subjects to control how many emails they receive. Most states then have subsequent data protection laws to add additional controls, the most stringent being New York and California.</p><p>More detail on US legislation can be found in the ITG Group Legal and Regulatory Policy, with state laws being detailed.</p><p>The European Court of Justice has recently invalidated the EU-US Privacy Shield, meaning that this cannot be used to govern the transfer of data to the US. As stated in para 4.8 binding corporate rules or standard contractual clauses must now be used.</p><p>More detail on specific US state data protection legislation comparison can be found here:</p><p><a shape="rect" href="https://iapp.org/resources/article/us-state-privacy-legislation-tracker" class="external-link" rel="nofollow">https://iapp.org/resources/article/us-state-privacy-legislation-tracker</a> </p><h4 id="DataProtectionPolicy-5.2CanadianDataProtection"><strong>5.2 Canadian Data Protection</strong></h4><p>Canada has the Canada’s Anti-Spam Legislation (CASL) and the Personal Information Protection and Electronic Documents Act (PIPEDA) that governs the sending of emails and electronic communication in connection with commercial activity i.e. Commercial Electronic Messages (CEM’s) and the required data protection measures for the protection of personal data.</p><p>The main rules behind CASL state:</p><ul><li><p>Determine if you are sending CEMs.</p></li><li><p>Identify the channels through which you send CEMs.</p></li><li><p>Assess if you have implied or express consent to send CEMs or if an exemption applies.</p></li><li><p>Develop a plan to obtain any required consents.</p></li><li><p>Make sure your CEMs contain the content required by CASL.</p></li><li><p>Determine how CASL may affect your policies, processes, customer relationship management (CRM) and other IT systems, and staff training and awareness programs.</p></li><li><p>Revise your policies, processes and systems as required Keep an audit trail, since CASL contains a “due diligence” defence.</p></li></ul><p>Storyteq ensures all its systems and processes are compliant with data protection legislation including CASL and PIPEDA. All systems and associated services have all required data protection legislation assessed and compliance requirements applied.</p><p><strong>Any questions or additional requirements, such as a DPA or DPIA, can be sent to either Storyteq on </strong><a shape="rect" href="https://storyteq.com/contact/" class="external-link" rel="nofollow"><strong>https://Storyteq.com/contact/</strong></a><strong> or the group DPO on </strong><a shape="rect" href="mailto:Dataprotection@teamitg.com" class="external-link" rel="nofollow"><strong>Dataprotection@teamitg.com</strong></a></p> <div class="table-overlay full reveal article__content" data-vp-id="js-table-overlay"> <i18n-message i18nkey="modal.cta.close.label" attribute="title"> <button class="close-button table-overlay__close" data-close title="Close modal" type="button"> <span aria-hidden="true">×</span> </button> </i18n-message> <div class="table-overlay__content"></div> </div> </section> </div> </main> </div> </div> <footer data-vp-component="footer" class="footer hc-footer-background-color"> <div class="grid lg:flex footer--alignment hc-footer-font-color vp-container"> <div class="flex hc-footer-font-color"> <img src="../__assets-7375bbea-cbb4-42bd-8052-aec5fb125808/image/Storyteq_TEQ%20White%20LBlue_RGB.png" class="footer__logo" alt=""> </div> <div class="grid"> <div class="footer__links"> </div> <ul class="footer__attribution-line--copyright hc-footer-font-color"> <li> <i18n-message i18nkey="footer.copyright.label" options='{ "date": "2024", "by": "Storyteq. All rights reserved." }'> Copyright © 2024 Storyteq. All rights reserved. </i18n-message> </li> <li> <span aria-hidden="true">•</span> <i18n-message i18nkey="footer.poweredBy.label">Powered by</i18n-message>   <a href="https://www.k15t.com/go/scroll-viewport-cloud-help-center" rel="noopener nofollow" > Scroll Viewport </a>   &   <a href="https://www.atlassian.com/software/confluence" rel="noopener nofollow" > Atlassian Confluence </a> </li> <li id="vp-js-cookies__reset-link"></li> </ul> </div> </div> </footer> <div id="vp-js-mobile__navigation"></div> <div class="vp-error-log"> <div class="vp-error-log__backdrop"></div> <div class="vp-error-log__modal"> <div class="vp-error-log__header"> <i18n-message i18nkey="preview.errorLog.header.label" ns="common"> JavaScript errors detected </i18n-message> </div> <div class="vp-error-log__content"> <p> <i18n-message i18nkey="preview.errorLog.content.0" ns="common"> Please note, these errors can depend on your browser setup. </i18n-message> </p> <ul data-error-log-list> <template class="vp-error-log__item--template"> <li></li> </template> </ul> <p> <i18n-message i18nkey="preview.errorLog.content.1" ns="common"> If this problem persists, please contact our support. </i18n-message> </p> </div> <div class="vp-error-log__footer"> <a class="vp-button vp-button--primary" href="https://k15t.jira.com/servicedesk/customer/portal/3" rel="noopener"> <i18n-message i18nkey="preview.errorLog.cta.support.label" ns="common"> Contact Support </i18n-message> </a> <a class="vp-button vp-button--secondary" id="error-log-close-button" tabindex="0"> <i18n-message i18nkey="preview.errorLog.cta.close.label" ns="common"> Close </i18n-message> </a> </div> </div> </div> <script> (function() { // set the inapphelp attributes as early as possible to avoid flashing content that should be hidden const searchParams = new URL(location.href).searchParams; if (searchParams.get('inAppHelp') === 'true') { const inAppHelpClasses = ['vp-in-app-help']; if (searchParams.get('title') === 'false') { inAppHelpClasses.push('vp-in-app-help--no-title'); } document.body.classList.add(...inAppHelpClasses); } }()); </script> <script> if(!false) { window.scrollHelpCenter.initializeCookieRelatedFeatures(); } </script> <script src="../__theme/js/app--3ec0c5a527cb5e835307.js"></script> </body> </html>

CINXE.COM

Data Protection Policy