Privacy policy

1. ABOUT THIS POLICY

1.1 Welcome to Storytel! We hope that you will enjoy our services. This Privacy Policy (the “Policy”) explains how we process your personal data in relation to any of our Storytel Services provided to you as described in any of our terms and conditions (collectively the “Agreement”), as well as when you choose to visit our website, when you download our applications, or when you use any of our products (collectively the “Services”).

1.2 The purpose of this Policy is to inform you about the processing of your personal data and to assure you that your personal data is handled with care and transparency. You should always be able to feel safe when providing personal data to Storytel and we are continuously working on assuring that necessary technical and organisational security measures are in place. If you still have questions after reading this Policy, you are welcome to contact us by using the contact information in section 14 below.

2. CONTROLLER

Storytel Sweden AB (company reg. no. 556696-2865), is the responsible Controller for the overall processing of your personal data in the context of the Services and the different stages thereof. In some situations, we may share this responsibility with one of our group companies, or a company outside our structure, for instance if a group company carries out local marketing activities.

3. CATEGORIES OF PERSONAL DATA THAT STORYTEL COLLECTS

3.1 Storytel processes the categories of personal data described below. Which data Storytel processes about you to some extent depends on which parts of Services you choose to use. The tables in this section 3 contain descriptions of the different categories of personal data that we may process about you, throughout the different steps of your customer journey. In section 4, you can also find more information about our purposes and legal bases for our different processing activities.

3.2 Creating an account at Storytel

3.2.1 When you create an account at Storytel, we may collect the following categories of data, depending on the Service that you are using and the market you are in.

Category

More specifically

User Data

Om du skapar ett konto hos Storytel så kommer vi att behandla de personuppgifter som du tillhandahåller, såsom: Full name Username Contact details (for example, email address or telephone number) Address IP-address Payment information (for example, type of credit card and expiry date of the card) Type of subscription Technical information (such as time logs connected to the creation of the account). The exact information required in order to create an account may vary depending on the subscription type and country as well as the type of payment method you use.   We may also process your date of birth, gender and family composition (more about this below), if you choose to submit this information. If you sign up for a Student discount we will process your personal data in order to verify your student status such as your date of birth and your current student status (such as the name of the university you study at).

3.2.2 When you use our Services

Category	More specifically
Usage Data	We may process personal data relating to your use of the Services, such as: Your choices of titles. Search history and other types of streaming related data such as time spent in our app and the bookshelves you create. Content that you choose to provide while using our Services, such as reviews, communication with customer support, or communications sent through our social media channels. Personal data necessary to provide additional features in our Services that you may choose to use, such as when you choose to refer a title or gift a free trial period to another person. Data related to your navigation on the website and app and technical data such as online identifiers, advertising ID, device and platform versions, IP address, app version, language settings, URL details, and browser type. Data that enables us to discover and connect with third party devices or services, which you choose to connect with via Bluetooth, plugins or other integrations. Geographic location data (excluding geolocation data) derived from other data points, for instance payment currency or the country of the website you have used to sign up. Your preferences, streaming history, browsing behaviour and other data related to your use of our Services.   You may personalise your account even more and/or use some of our optional social features offered within the website or app from time to time. For these features (collectively the “Social Features”) we will process the personal data that you choose to provide us, for instance: Your name or username Profile picture Reviews about our content Comments on other users’ reviews   Please note that your chosen name or username will always be visible to other users in the app and may be visible on the web if you choose to create a review.
Preview Mode Data	When you choose to use our app in preview mode (before creating an account), we will collect the preferences that you choose to share with us, as well as information regarding the titles in your bookshelf.
Shipping Data	If you purchase our products, for instance our Reader, we will collect data such as your shipping address.

3.2.3 Payment Data, Contests and Survey/User Research Data

Category	More specifically
Payment Data	We will, depending on your chosen payment method, process Payment Data in forms of for example credit card details and/or other payment details, including for example account number, name, surname and purchase history. No full payment details are processed by Storytel (such as full credit card numbers). If you want more information, we recommend that you contact your payment service provider to find out more about how they process data relating to your payments.
Contest and Survey/User Research Data	If you choose to participate in any of our contests, surveys or user research, we will process the data that you choose to provide us, including any categories as mentioned in this Privacy Policy.

3.2.4 Third Party Dat

Category

More specifically

Third Party Data

If you choose to link your account to your Facebook account or accounts of other third party services when you log in, we will process personal data for which you give Facebook or the relevant third party permission to share with Storytel. If you want to know more about this, please turn to the specific service provider.   If you choose to connect your account to a product or a third party streaming platform, we will process User Data necessary to enable this and to fulfil our legitimate interests connected with such integration.   If shipping data is provided to us by a third party, (for instance if you choose to buy our Services from a third party) it is classified as Third Party Data.

3.2.5 Cookies Data

Category	More specifically
Cookie-uppgifter	Cookies data may be used to facilitate your access, remember your settings, to be able to show you personalised marketing communications, and to measure the success of our marketing activities. More information on Storytel’s use of cookies can be found in our cookie declaration, published on the Storytel website. Click here for a direct link to our cookie declaration.

3.3 Please take note: If you choose to provide data about your family members or other personal data, you are responsible to ensure you have the right to do so based on their permission and you must also inform them about our processing activities.

4. PURPOSES, CATEGORIES AND LEGAL BASES

4.1 In the table below you can find a description of our purposes for processing personal data and information on how they relate to different categories of personal data and which legal basis we use for the processing. For more information on the respective categories, please see the definitions of categories of data above under section 3.

4.2 Please also find a short description of the different legal bases below:

• Legitimate interest: This legal basis applies where Storytel has an interest in processing your personal data for a certain purpose where we consider our interest to outweigh your interest, taking into account the impact and risk that the processing may have on your rights.
• Contractual obligation: This legal basis applies when Storytel needs to process your personal data to comply with a contract that we have, or are preparing to, enter into with you.
• Legal obligations: This legal basis applies where Storytel needs to process your personal data to comply with a legal requirement/regulation that applies to us.
• Consent: This legal basis applies to specific types of processing activities where your active approval is necessary and where Storytel will request that you provide such approval for Storytel’s use of your personal data for such purposes.

Purpose for processing	Categories of personal data	Legal basis for processing
Provision of our personalised Services, for example: We may provide you with content suggestions and a personalised feed based on your language, gender, preferences, browsing- and streaming history. Verify which market you are using the Service in, and which content you accordingly should have access to. Provide you with our Social Features, as requested by you, including a more personalised profile, reviews on content and other users reviews. Enable you to purchase gift cards. Remember your settings.	User Data	Contractual obligation Legitimate interest
	Usage Data
	Preview Mode Data	Legitimate interest
	Cookies Data	Legitimate interest (necessary cookies) Consent (other cookies)
	Payment Data	Contractual obligation
Fulfilling our contractual obligations with third parties: Such as licensing agreements and platform partnerships.	User Data	Legitimate interest Consent
	Usage Data
	Cookies Data
Development, maintaining and improvement of our Services: Assess the quality and success of the content based on your use of the Service and for instance reviews, in order to improve the Services. Develop new and improved features, technologies and services based on analysis of your use of the Services. Business planning and forecast development.	User Data	Legitimate interest
	Usage Data
	Preview Mode Data
	Cookies Data	Consent
To inform you of our Services: Through different communication channels, such as email , sms, in app notifications and push notifications	User Data	Legitimate interest Contractual obligation
	Usage Data
To market and promote our Services: Through newsletters, in app and push notifications as well as third party platforms (for instance, social media). Non personalised ads and offers. Personalised ads, offers and newsletters from Storytel or Storytel’s partners based on your preferences, streaming history, browsing behaviour and other use of our Services. Determine eligibility for special offers (for example, to establish if you are eligible for a trial subscription). Analyse the relevance and reach of our campaigns and marketing activities, or to reduce the risk of sending irrelevant marketing material to you. When we personalise our communication through third services, this may be based on your online behaviour, your use of our Services or other third party services, such as a social media service, or a combination of the above. If an active consent for newsletters is required, we will ask for your consent.	User Data	Legitimate interest Consent (for the personalised ads, offers and newsletter from Storytel or Storytels partners).
	Usage Data
	Cookies Data	Consent
Process your payments: Through our different payment methods, available on our website and through gift cards. Collect due payments for use of the Service. Check and administer your payments for our Services. Determine the chosen method of payment, and verify that it is valid. Administer gift cards.	Payment Data	Contractual obligation
		Legal obligations (such as Tax purposes and accounting)
	User Data	Contractual obligation
Connect with third party product or service: If you choose to sign up by using third party services (e.g. Facebook and Google), we will receive data from that third party service provider, provided that you have given your permission to the integration.	Third Party Data	Contractual obligation
	Cookies Data	Consent
		Legitimate interest (for necessary cookies)
To provide Customer Support services, including to: Communicate with you. Offer support for our Services and handle requests from you. Ensure that you can use our Services. Improve our Services as a result of questions and/or feedback that you communicate to us. Please note: If you choose to contact us through third-party social media platforms, they will be the controller of their own processing.	User Data	Legitimate interest (e.g. to preserve our legal rights, answer your questions and to improve our Services as a result of questions and feedback) Legal obligations (e.g. to handle your data subject requests) Contractual obligation
	Usage Data
	Payment data
	Third Party Data
To comply with legal obligations and requests from competent authorities.	All categories of personal data listed in section 3	Legal obligations
Prevention and detection of fraud and unlawful use of our Services and to secure our Services and platform.	All categories of personal data listed in section 3.	Legitimate interest Legal obligations
Participation in surveys, contests and research If you choose to participate in a survey, contest or research activity in relation to the Services, we will process the personal data that you choose to provide.	Contest and Survey/User Research Data	Legitimate interest
		Consent (to the extent consent is required for processing of personal data based on the survey, contest or research study at hand, we will ask you for that)
	User Data	Contractual obligation (such as contest terms)
	Usage Data	Consent Contractual obligation (such as research study terms)

5. CHILDRENS DATA AND AGGREGATED DATA

5.1 Childrens Data: Please note that the Storytel Services are not intended for children under the age 18. We assume that all personal data provided in our Services are provided by persons that can legally enter into our Agreement. If we are made aware that a person under the age 18 has provided personal data by use of our Services, without the necessary parental consent, we will delete that data to the extent possible. This may mean that we need to delete the account in question.

5.2 Aggregated data: We may also process aggregated data that is not identifiable with an individual (no longer personal data) but that derives from any of the categories of data in section 3.

6. HOW LONG DO WE PROCESS YOUR PERSONAL DATA?

6.1 Storytel will process your personal data for as long as we have a purpose and legal ground, for example as long as we have a contractual obligation, legitimate interest, your consent, or legal obligations to process your data, depending on which of these legal bases are applicable.

6.2 We process your personal data for as long as you have an account with an active subscription and for 24 months after your subscription has ended to provide you with the personalised Storytel Service (for example to maintain your library of audiobooks/ebooks, so you can easily pick up where you left off, and to enable analysis of your use of our service).

6.3 When you contact Storytel to receive support or for other purposes, we will retain your personal data for twenty-four (24) months after dealing with your last support ticket (e.g. problems and requests).

6.4 The personal data retained in our administration is retained for seven (7) years for tax and customs administration purposes unless we are legally obliged to retain the data for another period of time.

6.5 Personal data which is collected and processed for marketing purposes, is retained for as long as you have an account and 12 months after expiry of your subscription and/or your last login (depending on the option that ends last).

6.6 Storytel may retain data for longer than the time periods specified in this section, if legally prescribed or if it is necessary to preserve and defend Storytel’s legal interests, for example, during judicial proceedings.

6.7 We may retain aggregated data through which you cannot be identified (no longer personal data) for an unlimited period of time.

6.8 If we use consent as a legal basis, we will process your data until you retract your consent.

7. WHERE IS YOUR PERSONAL DATA STORED?

We strive to process your personal data within the EU/EEA. However, your personal data may also be processed in the country where a Storytel group company has a local establishment, where our suppliers that are mentioned in clause 10 or their sub-suppliers are located. For transfers outside the EU/EEA, please see more under section 8 and 10.

8. DATA SECURITY AND INTEGRITY

The security, integrity and confidentiality of your personal data is of vital importance to us. We have implemented appropriate technical, administrative and physical security measures to safeguard your personal data against unauthorised access, use, alteration and disclosure. We regularly review our security procedures to assess whether we must implement additional measures or improve existing procedures. In the case where you have created a password for the

use of our Services, we ask you to keep it safe and not to share it with anyone. You should be aware that no transmission of information over the internet can be safeguarded fully

9. SHARING OF YOUR PERSONAL DATA

9.1 We will only share your personal data in accordance with the below.

9.2 We may share your personal data with our Storytel group companies in order to provide you with the Services provided by our group, to carry out our daily operations, or for the purpose of improving our services.

9.3 We may also share personal data with our business partners (for example content providers and payment providers), such as your User Data and Usage data, in order to fulfil our contractual obligations with them and be able to provide you with our Services. Another example is if you use a third party platform that you choose to connect to us. In such cases may share User data and/or Usage data as necessary to enable the technical connection and to manage our business relationship with such third party platform.

9.4 Storytel may also share personal data with some of our service providers involved in for instance the provision of our IT systems, customer service, security, or business analysis.

9.5 We may also share personal data with marketing service providers that we use to provide you with personalised ads and marketing communications, to send you relevant communications and to measure the success and reach of our digital marketing and other promotional activities in reports and market research. This is the case when Storytel uses remarketing or interest based advertising (also known as targeted advertising).

9.6 We may also share personal data with payment service providers, as necessary in order to provide you with different payment methods and to process your payments.

9.7 Personal data may also be shared to comply with statutory obligations or requirements or request from authorities, to safeguard our legal interests, or to detect or prevent fraud and to secure our Services.

9.8 Storytel may share your personal data if we initiate discussions with a prospective buyer of our company or parts of our company, or if such negotiations result in a sale of the company or parts thereof. We will during this process continue to protect your data and notify you if your data will be transferred to a buyer.

9.9 We may also share aggregated data that is not identifiable with an individual (no longer personal data).

10. TRANSFERS OF PERSONAL DATA

10.1 As a multinational company, we may process your personal data within the EU/EEA or outside of these areas depending on which of the Services that you use, where our Storytel group companies are located or where our service providers are located. If we transfer your data to another country, such transfers are made to the previously described categories of recipients in section 9, and for the purposes as set out in this Policy.

10.2 We may transfer personal data to countries outside the EU/EEA, which the EU Commission has confirmed to have acquired an adequate level of protection according to GDPR art 45. If we transfer data to other countries, we will use an appropriate legal mechanism, for example the Standard Contractual Clause originated from the European Commission according to GDPR art 46.2 (c) and adhere to applicable data protection regulations.

11. LINKS TO EXTERNAL WEBSITES/SERVICES

Information provided by Storytel may contain links to websites or services operated or owned by parties other than Storytel, for example some of our payment providers or other business partners. Storytel is not responsible for the processing of personal data (i.e. not the responsible Controller) on these websites. We recommend that you read the information regarding the processing of personal data on the relevant websites carefully.

12. CHANGES TO THE PRIVACY POLICY

This Policy may be revised from time to time and we may also add new features or services that will be included in the Policy. If Storytel makes significant changes to the Policy, we will inform you about it by email, a device that you use for the Services or via a notification in the Services, depending on what is appropriate. The latest version of the Policy is published on Storytel’s website. If your acceptance is needed, Storytel will make sure to collect it. Please read this Policy regularly to stay updated on the content.

13. YOUR RIGHTS BASED ON EU/EEA LEGISLATION AND YOUR DATA PROTECTION CONTROLS

13.1 Your rights

13.1.1 Processing of personal data under the General Data Protection Regulation is associated with rights for you to be informed about and affect the way we process your data. The individual rights are described below and may be subject to limitations in applicable law.

• Right of access: you have the right to be informed of and to access the personal data we process about you.
• Right to rectification: you have the right to request to amend or update your personal data in the event it is inaccurate or incomplete.
• Right to erasure: you have the right to request that we delete your personal data. This right may be subject to restrictions, for example if you have an ongoing case with customer support, or if your contractual obligations have not been fulfilled in terms of payment, or if we have a legal obligation to retain your data, for instance based on applicable bookkeeping regulations.
• Right to restrict: you have the right to request that we restrict the processing of all or parts of your personal data.
• Right to object: you have the right to object to us processing your personal data, for instance when such processing is based on legitimate interest, depending on the circumstances.
• Right to data portability: you have the right to request a copy of the personal data that you have provided us, in an electronically readable format and to forward that data.
• Right to lodge a complaint: you have the right to submit a complaint to the competent supervisory authority, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten – IMY) or any other competent supervisory authority in the country of residence, if you believe that we have unlawfully processed your personal data.

13.2 Data Protection Controls

13.2.1 If the processing is based on your consent, you can always retract your consent by sending us an email to the contact information below or by using the specific feature we have informed you about when collecting your consent.

13.2.2 Apart from this, you have the opportunity to opt out of receiving our newsletters in a link provided to you in each newsletter. You can manage your cookie preferences by using the cookie banner on our website.

13.2.3 Information about additional data protection control features can be found in our Help Center.

14. WANT TO KNOW MORE?