Privacy Policy

1. Overview & Data Controller Identification

Storyshelf Navigator Media Ltd. ("we", "us", "our", or "Storyshelfnavigator") operates the website storyshelfnavigator.motorcycles. This Privacy Policy explains our practices regarding the collection, processing, transfer, storage, and erasure of personal information gathered from readers, music professionals, and contributors across the European Economic Area (EEA), United Kingdom, and global jurisdictions.

Data Controller Contact Details:
Storyshelf Navigator Media Ltd.
Data Protection Officer: Legal Compliance Bureau
Address: 42 Friedrichstraße, Level 4, 10117 Berlin, Germany
Email: [email protected]

2. Categories of Data Collected

We process the following categories of data in accordance with strict data minimization principles:

• Voluntarily Provided Information: When you submit a club review, contact editorial, or submit a venue audit, we collect your name, email address, company or artistic affiliation, and message content.
• Device & Interaction Metadata: IP address (anonymized at capture), browser user-agent, operating system, referring URL, timestamp, map interaction nodes clicked, and preferred sound system filters.
• Local Storage State: Essential preference tokens, including your cookie consent decision saved locally inside your web browser (`atlas_cookie_consent`).

3. Legal Grounds for Processing (GDPR Article 6)

We process personal data solely on legitimate grounds recognized under European law:

• Consent (Art. 6(1)(a)): Explicit consent given when accepting analytical cookies or subscribing to schedule notifications.
• Performance of a Contract (Art. 6(1)(b)): Responding to venue audit submissions and verified curator inquiries.
• Legitimate Interests (Art. 6(1)(f)): Maintaining network security, preventing spam submissions on contact forms, and optimizing server loads for global mapping traffic.

4. Third-Party Processors & Infrastructure

We do not sell, rent, or trade your personal data. We utilize strictly audited infrastructure partners operating under Standard Contractual Clauses (SCCs) and GDPR Data Processing Agreements (DPAs):

• Hosting & Edge Delivery: Scalable cloud providers with European server locations (Frankfurt, Amsterdam, London).
• Font & Icon Assets: Hosted through local fallbacks and privacy-preserving content networks stripping tracking parameters.

5. Your European Privacy Rights (GDPR / UK DPA)

Under European data protection law, you hold the following non-derogable rights:

1. Right of Access (Art. 15): Request a copy of all personal records held about you.
2. Right to Rectification (Art. 16): Correct inaccurate or outdated information.
3. Right to Erasure / 'To Be Forgotten' (Art. 17): Request deletion of your submission records.
4. Right to Restriction of Processing (Art. 18): Limit the scope of data operations.
5. Right to Data Portability (Art. 20): Receive your structured data in machine-readable format.
6. Right to Object (Art. 21): Object to any processing based on legitimate interests.

To exercise any of these rights, email our Data Protection Officer at [email protected] with the subject line "GDPR Subject Access Request".

6. Data Retention & Security Protocols

Contact submissions and technical audit communications are retained for a maximum of 24 months, after which they are irreversibly purged or anonymized. We implement industry-grade TLS 1.3 cryptographic transport protocols, DNSSEC, and firewalls to prevent unauthorized access.