Privacy Policy

1. Data Controller

The Data Controller responsible for the processing of personal data on this website is Nathan McCabe (trading as Starfall Stories), established in Groningen, the Netherlands. You can reach out regarding any data privacy matters through our Contact Page.

2. What Data We Collect & Why

We operate on a principle of data minimization. We only collect the minimal personal data strictly necessary to fulfill your orders and deliver newsletters:

• Newsletter & Dispatch Subscriptions: Your email address, collected only with your explicit consent (Art. 6(1)(a) GDPR) to send occasional short stories, updates, and publication dispatches. You may unsubscribe at any time with a single click.
• Orders & Physical Fulfillment: Your name, postal address, and email address, collected to perform our sales contract with you (Art. 6(1)(b) GDPR) and mail physical print editions via PostNL.
• Direct Correspondence: Your name, email, and message content submitted through our contact form, processed under legitimate interest (Art. 6(1)(f) GDPR) to reply to your inquiry.

3. Third-Party Sub-Processors

We never sell, rent, or trade your personal information. We partner only with trusted, GDPR-compliant infrastructure partners:

• Stripe (Payments): Stripe Payments Europe, Ltd. handles checkout transactions securely under rigorous PCI-DSS Level 1 compliance.
• Postal Carriers (PostNL): Physical delivery addresses are shared solely with national postal services to fulfill letterbox dispatches.
• Hosting Infrastructure: Hosted within European data centers ensuring strict compliance with EU data protection regulations.

4. Cookies & Tracking Technology

Starfall Stories uses zero third-party advertising trackers, zero invasive behavioural profiling scripts, and zero cross-site trackers. Only strictly necessary functional session cookies (such as remembering your chosen motion preferences or shopping cart state) are utilized. Because we do not track you across the web, you will not encounter annoying consent popups.

5. Data Retention

Newsletter subscriber emails are kept until you choose to unsubscribe. Order and invoice records are retained in compliance with statutory Dutch tax obligations (7 years) and securely archived thereafter.

6. Your Rights Under the GDPR

As a European data subject, you hold the following statutory rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate information.
• Right to Erasure ("Right to be Forgotten"): Request complete deletion of your data where statutory retention laws allow.
• Right to Restriction of Processing & Portability: Obtain your data in a portable format.
• Right to Lodge a Complaint: You have the right to contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.