Privacy Policy
Last updated: 29 September 2026
Business: Strategy & Story
Website: www.strategyandstory.co
Contact: hello@strategyandstory.co
1. Introduction
At Strategy & Story, we respect your privacy and are committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, enquire about our services, work with us, purchase our products, subscribe to our mailing list or otherwise interact with our business.
We process personal information in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as applicable.
For the purposes of applicable data protection legislation, Strategy & Story is the data controller for the personal information described in this policy, unless otherwise stated.
2. Information We Collect
We may collect and process the following categories of personal information.
Information you provide directly
When you contact us, complete a form, book a discovery call, purchase a service or enter into a contract with us, we may collect:
Your name and business name.
Your email address and telephone number.
Your business address and billing details.
Information about your business, marketing requirements, objectives and challenges.
Information you provide when completing questionnaires, briefs, surveys or onboarding forms.
Details of your enquiries, correspondence, proposals, contracts and purchases.
Payment and transaction information, processed where applicable by our payment providers.
Information collected automatically
When you visit our website, we may collect certain technical information, including:
Your IP address.
Browser type and device information.
Website usage, pages visited and interactions.
Referral sources and general location information.
Cookie identifiers and analytics information, where applicable.
Information from third-party sources
We may collect professional contact information from publicly available sources, such as company websites, professional networking platforms, business directories, Companies House and relevant business publications.
This may include names, job titles, company names, professional email addresses and publicly available business information.
We use this information for relevant B2B prospecting, business development and relationship management, subject to applicable data protection and electronic marketing requirements.
Where we obtain personal information indirectly, we provide the required privacy information in accordance with applicable law.
3. How We Use Your Information
We may use your personal information for the following purposes:
Responding to enquiries
To respond to questions and requests.
To arrange discovery calls and consultations.
To prepare proposals, quotations and recommendations.
Delivering our services
To provide marketing consultancy, strategy, campaign management and other contracted services.
To manage projects, communicate with clients and deliver agreed work.
To provide access to digital products, courses, resources and memberships.
To administer client accounts, payments and subscriptions.
Marketing and business development
To send relevant business communications and marketing materials where permitted by law.
To conduct appropriate B2B prospecting and follow up on professional enquiries.
To share updates about our services, resources, events and offerings where you have consented or another lawful basis applies.
To manage mailing list subscriptions and marketing preferences.
Improving our business
To analyse website traffic and engagement.
To improve our website, services, products and customer experience.
To conduct internal reporting and business planning.
Legal and administrative purposes
To maintain accurate financial and business records.
To comply with legal, tax and regulatory obligations.
To establish, exercise or defend legal claims.
To prevent fraud, misuse and security incidents.
4. Our Lawful Bases for Processing
We only process personal information where we have an appropriate lawful basis under applicable data protection legislation.
Depending on the circumstances, these may include:
Contract: Where processing is necessary to enter into or perform a contract with you, such as delivering marketing services, providing a membership or processing a purchase.
Legitimate interests: Where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include relevant B2B business development, managing client relationships, improving our services and maintaining business records.
Consent: Where you have given clear permission for a particular use of your information, such as receiving certain marketing communications or consenting to non-essential cookies where required.
Legal obligation: Where we need to process information to comply with applicable laws, including accounting, taxation and record-keeping requirements.
Where we rely on legitimate interests, we consider the nature of the processing, its impact on individuals and any reasonable expectations or objections.
You can object to processing based on legitimate interests at any time. You can also withdraw consent where processing is based on consent.
5. Email Marketing and Business Development
We may contact businesses and professional contacts about services that are relevant to their business activities.
Where we collect professional contact information from publicly available sources, we use it responsibly and in accordance with applicable data protection and electronic marketing laws.
We distinguish between corporate subscribers and individual subscribers, such as sole traders and certain partnerships, because different electronic marketing rules may apply.
Where required, we obtain consent before sending direct marketing communications. We do not treat publicly available contact details as automatic permission to send marketing emails.
All marketing communications will identify Strategy & Story and provide an appropriate means of opting out or unsubscribing.
You may opt out of marketing communications at any time by using the unsubscribe link in our emails or contacting us directly.
We may retain limited suppression information to ensure that we respect your decision not to receive further marketing communications.
6. How We Share Your Information
We do not sell your personal information.
We may share information with trusted third-party service providers where necessary to operate our business and deliver our services, including:
Website hosting and website management providers.
Customer relationship management (CRM) platforms.
Email marketing and communication providers.
Scheduling and form management platforms.
Payment processors and accounting software.
Cloud storage, file-sharing and productivity platforms.
Analytics and website performance providers.
Professional advisers, including accountants, insurers and legal advisers.
These providers may process personal information on our behalf or, where applicable, act as independent controllers.
We require appropriate safeguards and contractual protections where applicable.
We may also disclose information where required by law, to protect our legal rights, or in connection with a business transfer, restructuring or sale, subject to applicable legal requirements.
7. International Data Transfers
Some of our service providers may store or process personal information outside the United Kingdom or the European Economic Area.
Where personal information is transferred internationally, we will ensure that an appropriate transfer mechanism or safeguard is in place where required by applicable data protection legislation.
These safeguards may include adequacy regulations or decisions, approved standard contractual clauses or the UK International Data Transfer Agreement, as applicable.
You can contact us for further information about relevant international transfer safeguards.
8. How Long We Keep Your Information
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, accounting and reporting requirements.
Our intended retention periods are:
General enquiries: up to 24 months after the last meaningful interaction, unless a longer period is justified.
Unsuccessful business prospects: up to 12 months after the last meaningful interaction, unless there is an ongoing legitimate business reason to retain the information.
Client and project records: for the duration of the relationship and generally up to six years afterwards where required for contractual, accounting or legal purposes.
Financial and tax records: for the applicable statutory retention period.
Marketing subscriptions: until you unsubscribe or withdraw consent, with minimal suppression information retained as necessary to respect your preferences.
Website analytics: in accordance with the retention settings of our analytics providers and applicable cookie requirements.
We may retain information for longer where necessary to establish, exercise or defend legal claims, or where required by law.
When information is no longer required, it will be securely deleted or anonymised.
9. Your Data Protection Rights
Depending on the applicable law and circumstances, you may have the right to:
Access your personal information and request a copy.
Rectify inaccurate or incomplete information.
Erase personal information in certain circumstances.
Restrict the processing of your personal information in certain circumstances.
Object to certain processing activities, including direct marketing.
Data portability where the relevant legal conditions apply.
Withdraw consent at any time where we rely on consent.
You also have the right to lodge a complaint with the relevant supervisory authority.
To exercise your rights, please contact us at [Insert privacy contact email].
We may need to verify your identity before responding to a request. We will respond within the applicable statutory timeframe.
10. Cookies and Website Tracking
Our website may use cookies and similar technologies to support functionality, understand website usage and improve user experience.
These may include:
Essential cookies: necessary for the operation and security of our website.
Analytics cookies: used to understand visitor behaviour and website performance.
Marketing cookies: used, where applicable and permitted, to measure campaigns or support advertising activities.
Where consent is required, we will request it before placing non-essential cookies or using similar technologies.
You can manage your cookie preferences through our website's cookie settings and, where available, through your browser settings.
For more information, please see our [Cookie Policy, if published separately].
11. Data Security
We take appropriate technical and organisational measures to protect personal information against accidental loss, unauthorised access, disclosure, alteration or destruction.
These measures may include access controls, secure passwords, multi-factor authentication, appropriate staff or contractor access restrictions and the use of reputable service providers.
However, no internet transmission or electronic storage system can be guaranteed to be completely secure.
If a personal data breach occurs, we will assess and respond to it in accordance with applicable legal requirements.
12. Third-Party Websites
Our website may contain links to third-party websites, platforms or services.
We are not responsible for the privacy practices, security or content of external websites. We encourage you to review their respective privacy policies before providing personal information.
13. Children's Privacy
Our services are intended for businesses and adults. We do not knowingly collect personal information from children through our website for marketing or commercial purposes.
If we become aware that we have inadvertently collected such information, we will take appropriate steps to address it.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our business practices, technology, services or legal obligations.
Any updated version will be published on our website with a revised date.
Where changes materially affect how we use personal information, we will provide additional information or notification where required by law.
15. Contact Us
If you have questions about this Privacy Policy, wish to exercise your data protection rights or have concerns about how we process your personal information, please contact:
Strategy & Story
Email: hello@strategyandstory.co
Website: www.strategyandstory.co
Business address: 3rd Floor, 86 - 90 Paul Street, London, EC2A 4NE
Data protection enquiries: hello@strategyandstory.co
If you are unhappy with how we handle your personal information, you can complain to the UK Information Commissioner's Office (ICO) at https://ico.org.uk/, or the relevant supervisory authority in your jurisdiction.