Breezyrankshufflet
Statutory Governance

Privacy Policy

Formal declaration regarding data processing, personal rights under European and Norwegian data frameworks, and security protocols.

Effective Date: January 1, 2026
Data Controller: Breezyrankshufflet Nordic Expeditions AS (Org nr: NO 928 417 653 MVA), Bryggegata 14, 0252 Oslo, Norway.

1. Scope and Purpose

Breezyrankshufflet Nordic Expeditions AS operates the digital publication accessible via breezyrankshufflet.boats. This privacy policy informs readers of our principles and statutory protocols regarding the collection, transmission, processing, and safeguarding of personal information in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation / GDPR) and the Norwegian Personal Data Act (Personopplysningsloven).

2. Categories of Data Collected

We restrict data gathering to the minimum required to fulfill technical transmission and user-initiated communication:

  • Communication Records: When you send a message via our contact interface, we receive your name, email address, message subject, and correspondence history. The lawful basis for this processing is Article 6(1)(b) of the GDPR (taking steps at the request of the data subject prior to entering into a contract) and Article 6(1)(f) (our legitimate interest in addressing correspondence).
  • Technical and Server Logs: When accessing our servers, your browser transmits standard network telemetry, including IP address (anonymized at ingestion), browser identifier, operating system version, referring URL, and timestamp. The lawful basis is Article 6(1)(f) to maintain network stability, detect malicious activity, and ensure infrastructure resilience.
  • Cookie & Local State Tokens: With explicit consent, we may record preference choices and anonymous aggregate readership metrics as elaborated in our dedicated Cookie Policy.

3. Third-Party Processors and International Transfers

We do not sell, rent, or trade personal data to advertising brokers. Processing is limited to trusted infrastructure providers operating under strict Data Processing Agreements (DPAs):

  • Cloud hosting, domain routing, and web infrastructure providers located within the European Economic Area (EEA) or compliant with standard contractual clauses (SCCs) approved by the European Commission.
  • Encrypted email exchange servers maintaining strict transport layer security (TLS 1.3).

4. Statutory Data Rights (GDPR & CCPA)

Under European regulations and corresponding global frameworks such as the California Consumer Privacy Act (CCPA), you possess unequivocal rights regarding your personal information:

  • Right of Access (Article 15 GDPR): You may request confirmation and an unencrypted copy of personal data maintained in our records.
  • Right to Rectification (Article 16 GDPR): You may instruct us to correct inaccurate or incomplete biographical details.
  • Right to Erasure (Article 17 GDPR): You may request the permanent deletion of personal data where retention is no longer necessary for statutory or contractual compliance.
  • Right to Restriction and Objection (Articles 18 & 21 GDPR): You may object to data processing grounded in legitimate interests or demand processing suspension pending legal dispute resolution.
  • Right to Data Portability (Article 20 GDPR): You may receive your provided personal data in a structured, commonly used, and machine-readable format.

California residents are specifically informed that we do not sell personal information or share personal data for cross-context behavioral advertising as defined under the California Privacy Rights Act (CPRA).

5. Data Retention Periods

Personal correspondence submitted via our contact desk is retained for a maximum of 24 months to satisfy ongoing editorial context, after which records are purged or permanently scrubbed of identifying metadata. Technical web server connection logs are cycled and erased automatically after thirty (30) days.

6. Security Architecture

We implement rigorous technical safeguards, including strict HTTPS encryption across all endpoints, automated brute-force firewalls, least-privilege administrative access protocols, and cryptographic storage of local preference states.

7. Data Protection Officer & Supervisory Authority

To exercise statutory rights or address privacy concerns, contact our designated data compliance desk:

Data Protection Officer
Breezyrankshufflet Nordic Expeditions AS
Bryggegata 14, 0252 Oslo, Norway
Email: [email protected]

You retain the right to lodge a formal complaint with the Norwegian Data Protection Authority (Datatilsynet): Postboks 458 Sentrum, 0105 Oslo, Norway (www.datatilsynet.no).