1. Introduction & Scope

This Privacy Policy (“Policy”) describes how Storyline Strategies (Storyline Strategies, LLC, “we,” “us,” or “our”), located at PO Box 74, Union Hall, VA 24176, USA, collects, uses, shares, protects, and otherwise processes the personal information (“Personal Data”) of individuals who apply to join, or are members of, the Storyline Strategy Council (“SSC,” “Council,” or “Network”).

The Storyline Strategy Council is an exclusive, global network of professionals, policy experts, and industry leaders (“Council Members,” “Members,” “you,” or “your”) who opt-in to participate in paid market research studies and consulting engagements (“Projects”) conducted by Storyline Strategies for its clients (“Clients”).

Storyline Strategies is committed to protecting your privacy and handling your Personal Data responsibly and ethically. We strive to adhere to the principles of applicable data protection laws globally, including the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Privacy Rights Act (CPRA), and others, as well as relevant industry ethical standards like the ICC/ESOMAR International Code on Market, Opinion and Social Research and Data Analytics.

This Policy applies specifically to Personal Data processed in connection with your application to, and participation in, the SSC. It does not apply to general use of the main storylinestrategies.com website (governed by our separate Website Privacy Policy) or to data processed in other contexts (e.g., employee data). This Policy should be read alongside the Storyline Strategy Council Terms & Conditions.

2. Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person.
• “Processing” means any operation performed on Personal Data (e.g., collection, use, storage, disclosure).
• “Controller” means the entity determining the purposes and means of Processing Personal Data (which is Storyline Strategies for this Policy).
• “Processor” means an entity Processing Personal Data on behalf of the Controller (e.g., Rally, Tremendous).
• “Special Categories of Personal Data” / “Sensitive Personal Information” refers to data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data for identification, health data, or data concerning sex life or sexual orientation, as defined under applicable law (e.g., GDPR Article 9, CPRA).

3. Data Controller & Contact Information

Storyline Strategies (Storyline Strategies, LLC) is the Data Controller. Address: PO Box 74, VA 24176, USA

For privacy inquiries, DSR requests, or concerns: 

Privacy Office Email: info@storylinestrategies.com 

Postal Mail: 

Attn: Privacy Office, PO Box 74, VA 24176, USA

4. Personal Information We Collect

We collect Personal Data necessary for your participation in the SSC:

• Information You Provide Directly:
  • Contact & Identification Data: Name, email, phone, address, country of residence, language.
  • Professional & Biographical Data: Current/past employment, job titles, company details, industry, areas of expertise, skills, education, credentials, work history (often via resume/CV submission), links to public professional profiles (e.g., LinkedIn).
  • Screening Data: Responses to profile questionnaires and Project-specific Screeners assessing expertise, suitability, and conflicts.
  • Payment & Tax Data: Information needed by our payment processor (Tremendous) to issue honoraria (e.g., bank details, platform ID) and required tax forms (W-9/W-8BEN series via Tremendous or directly).
  • Communications Data: Correspondence between you and Storyline Strategies.
  • Consent Records: Records of your consent to Terms, Policies, and specific processing activities.
  • Demographic Data: Such as age range, gender, etc., if relevant for specific profiling and requested optionally with your clear consent.
  • Special Category/Sensitive Data: As noted below (Section 4.1).
• Information Collected Automatically:
  • Platform Usage Data: Technical data potentially collected via the Rally platform about your interactions (logins, activity), subject to Rally’s functionalities and terms.
  • Cookies: If accessing SSC resources via a web portal, necessary/functional cookies may be used (refer to portal-specific cookie notice if applicable).
• Information from Third Parties / Public Sources:
  • Verification Data: We may obtain information from third-party services to verify your identity, credentials, or conduct background checks where necessary and consented to or legally permitted.
  • Publicly Available Professional Data: We may collect or verify professional information (e.g., employment history, expertise areas) from publicly available sources like professional networking sites (e.g., LinkedIn), corporate websites, publications, or official registries to identify potential Council Members or supplement profiles.
  • Data Partners: We may obtain business contact information or professional profiles from reputable third-party data partners who provide assurances regarding the lawful collection of such data.

4.1. Special Category / Sensitive Personal Data: We typically do not require Special Categories of Personal Data (under GDPR) or Sensitive Personal Information (under CPRA) for general Council membership. If a specific Project or Screener requires such information (e.g., health information for a healthcare study, racial/ethnic origin for specific demographic research), we will only collect it with your explicit, informed consent for that specific purpose, explaining why it is needed and how it will be protected. You always have the right to refuse to provide such data.

5. How We Use Your Personal Information

Your Personal Data is used for the following specific purposes:

• Council Membership Management: Processing applications, verifying eligibility and identity, creating/maintaining your profile, administering your account, providing support, and communicating essential membership information.
• Project Matching & Facilitation: Using your profile and screening data (including automated profiling where appropriate) to identify relevant Project opportunities; sending invitations and Screeners; managing Project logistics; communicating with you about Projects.
• Research Execution: Collecting your insights, opinions, and responses during Projects (interviews, focus groups, surveys, etc.).
• Client Reporting: Providing research findings derived from Projects to the commissioning Client (typically in an aggregated and/or anonymized format, unless identifiable participation is explicitly consented to for a specific Project under an MNDA).
• Payment Processing: Facilitating accurate and timely honorarium payments via Tremendous and collecting required tax documentation.
• Profile Enrichment & Longitudinal Analysis: Appending coded summaries or key data points from your research responses to your SSC profile to maintain an accurate representation of your evolving expertise over time, improve the relevance of future Project invitations, and enable Storyline Strategies to conduct internal analysis of research trends (often using aggregated or anonymized data for broader insights).
• Compliance & Verification: Ensuring adherence to SSC Terms & Conditions, applicable laws, ethical codes, and Client compliance requirements; performing conflicts checks; conducting background verifications where necessary and consented to.
• Service Improvement & Security: Analyzing usage patterns (often aggregated/anonymized) to improve the SSC platform, services, and security; troubleshooting issues.
• Legal & Regulatory Obligations: Complying with tax laws, accounting requirements, legal proceedings, governmental requests, and defending legal claims.

6. Legal Basis for Processing (Primarily for GDPR/UK GDPR)

Our processing of your Personal Data relies on the following legal bases:

• Consent (Art. 6(1)(a) GDPR): For joining the SSC, processing your profile/screening data for matching, contacting you for Projects via chosen methods, collecting Special Category Data (Art. 9(2)(a) GDPR), and certain optional activities. You provide this via the Enrollment Consent Form and can withdraw it (see Section 11).
• Performance of a Contract (Art. 6(1)(b) GDPR): For processing necessary to fulfill our obligations under the SSC Terms & Conditions and specific Project agreements (e.g., facilitating participation in accepted Projects, processing payments).
• Legitimate Interests (Art. 6(1)(f) GDPR): For activities like initial outreach based on publicly available professional data, data verification, background checks (where permissible), internal analysis for service improvement, platform security, and communicating essential operational information, provided these interests are not overridden by your rights.
• Legal Obligation (Art. 6(1)(c) GDPR): For processing necessary to comply with laws (e.g., tax reporting, responding to legal process).

7. Data Sharing and Disclosure

We share Personal Data only when necessary and with appropriate safeguards:

• Within Storyline Strategies: Access limited to authorized personnel needing the information for the purposes described above.
• Service Providers (Processors): With third parties who process data on our behalf under contract (DPAs in place where required):
  • Rally UXR: For SSC database hosting, member management, communications.
  • Tremendous: For payment processing and tax form collection.
  • Others for IT hosting, security, communications, verification services, analytics, legal/accounting support.
• Clients:
  • Research findings are typically shared in aggregated or anonymized form.
  • Non-identifiable profile summaries (e.g., job title archetype, industry, years of experience) may be shared during screening to confirm suitability.
  • Your Identifiable Personal Data (name, company etc.) will NOT be shared with Clients without your explicit, prior consent, usually obtained per-Project via the Study-Specific MNDA or consent form. Exceptions are rare and relate to legal or specific Client compliance obligations (see below).
• Legal & Compliance Disclosures: We may disclose Personal Data if required by law, court order, or government request. In specific cases, Clients may have legal or regulatory obligations (e.g., pharmacovigilance, Sunshine Act) requiring disclosure of your identity and payment details related to a Project; we will endeavor to inform you if such requirements apply. We may also disclose data to protect rights, safety, or property, or investigate fraud.
• Business Transfers: Information may be transferred as part of a merger, acquisition, or asset sale.
• With Your Consent: For any other purpose disclosed to you for which you provide explicit consent.

We do not sell your SSC Personal Data or “share” it for cross-context behavioral advertising under CCPA/CPRA.

8. International Data Transfers

Your Personal Data is primarily processed in the United States and potentially other locations where Storyline Strategies or its service providers operate. For transfers of Personal Data from the EEA, UK, Switzerland, or other regions with specific transfer restrictions to countries not deemed “adequate” (like the US), we rely on appropriate safeguards, primarily the relevant Standard Contractual Clauses (SCCs) approved by the European Commission/UK ICO, supplemented by Transfer Impact Assessments (TIAs) where required, or other legally valid transfer mechanisms. You acknowledge that data stored or processed in other countries may be subject to access requests from governments, courts, or law enforcement according to the laws of those countries.

9. Data Security

We implement and maintain reasonable and appropriate technical and organizational security measures designed to protect your Personal Data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include, for example, access controls, data encryption (in transit and where appropriate at rest), secure development practices, vulnerability management, staff training, and incident response procedures. However, no system can be guaranteed 100% secure.

10. Data Retention

We retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected and processed, as outlined in this Policy. Key considerations include:

• Active Membership: Your profile data is retained while your SSC account is active.
• Post-Membership: After membership termination (by you or us), data may be retained for a limited period as required for legal, tax, audit, and compliance purposes (e.g., payment/tax records retained per statutory requirements), or to resolve disputes.
• Project Data: Research responses appended to your profile are generally retained as long as the profile is active but may be anonymized or aggregated for long-term analysis sooner. Study-specific raw data (recordings, transcripts) may have different retention periods defined per project.
• Inactivity: We may review profiles inactive for 2 years for potential deletion or anonymization, subject to legal holds.
• Anonymization: We may anonymize Personal Data for statistical or research trend analysis, in which case it is no longer subject to this Policy.

Specific retention schedules are maintained internally based on data type and legal obligations. Contact the Privacy Office for more details.

11. Your Privacy Rights

Depending on your jurisdiction (e.g., EEA/UK under GDPR, California under CCPA/CPRA, Canada under PIPEDA, Brazil under LGPD, etc.), you may have rights regarding your Personal Data processed by Storyline Strategies for the SSC. These rights commonly include:

• Right to Access: Request information about and access to the Personal Data we hold about you.
• Right to Rectification: Request correction of inaccurate Personal Data.
• Right to Erasure (Deletion / ‘Right to be Forgotten’): Request deletion of your Personal Data, subject to legal and contractual retention requirements.
• Right to Restrict Processing: Request limitation of our processing activities under certain circumstances.
• Right to Data Portability: Request to receive certain data you provided in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw previously given consent (this will generally result in termination of your SSC membership and cessation of related processing).
• Rights Related to Automated Decision-Making/Profiling: Request information about and potentially object to significant decisions based solely on automated processing.
• Right to Know/Access (CCPA/CPRA): Specific rights for California residents regarding categories/pieces of data collected, sources, purposes, sharing in the past 12 months.
• Right to Opt-Out of Sale/Sharing (CCPA/CPRA): As noted, we do not sell/share SSC data in this context.
• Right to Limit Use of Sensitive Personal Information (CCPA/CPRA): If we process SPI based on consent, you may have the right to limit its use.
• Right to Non-Discrimination: You will not be discriminated against for exercising your privacy rights.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority if you believe our processing infringes applicable law.

Exercising Your Rights: To exercise applicable rights, please contact our Privacy Office (Section 3). We will respond within the timeframes required by applicable law (e.g., typically within one month under GDPR, 45 days under CCPA/CPRA, potentially extendable). We will need to verify your identity before processing your request.

12. Children’s Privacy

The Storyline Strategy Council is intended for professionals meeting specific eligibility criteria and is not directed at individuals under the age of 18. We do not knowingly collect Personal Data from anyone under 18 for the SSC. If you believe we have inadvertently collected such information, please contact us immediately so we can delete it.

13. Changes to This Privacy Policy

We may update this SSC Privacy Policy periodically to reflect changes in our practices or legal requirements. We will post the updated version here (or on the relevant SSC platform) and revise the “Last Updated” date. For material changes, we will provide appropriate notice (e.g., via email or platform notification). We encourage you to review this Policy regularly.

14. Contact Us

For any questions, concerns, or requests relating to this SSC Privacy Policy or your Personal Data associated with the Council, please contact:

Privacy Office Email:
info@storylinestrategies.com

Postal Mail:

Storyline Strategies
PO Box 74 Union Hall, VA 24176

Last Updated: May 27, 2025