1. Introduction & Controller Identification
Brightsrankpantry Nordic Expeditions Ltd ("Brightsrankpantry", "we", "our", or "us"), registered under Norwegian company registration number NO 924 817 642 MVA, with registered offices at Havnegata 14, 8300 Svolvær, Lofoten, Norway, is the data controller responsible for the processing of personal data collected through brightsrankpantry.pics.
We are committed to operating in full accordance with Regulation (EU) 2016/679 (General Data Protection Regulation / GDPR), the Norwegian Personal Data Act (Personopplysningsloven), and applicable international privacy frameworks including the California Consumer Privacy Act (CCPA/CPRA). This policy details the categories of personal information we process, our lawful bases, data retention standards, and your rights under data protection legislation.
2. Categories of Data Collected & Processing Methods
We collect personal data strictly necessary to fulfill our editorial service and respond to user communications:
- Direct Correspondence Data: When you complete the inquiry form on our contact page or email us directly, we process your name, email address, thematic category of interest, and the textual contents of your inquiry.
- Technical Device & Connection Metrics: Automatically recorded server access logs containing internet protocol (IP) addresses, browser user-agent tokens, referring URLs, access timestamps, and operating system identifiers. IP addresses are truncated or anonymized in diagnostic server metrics.
- Consent Preferences: Local storage records detailing your selected preferences regarding essential, analytical, and preference cookies.
3. Lawful Bases for Processing (GDPR Art. 6)
Every processing activity conducted by Brightsrankpantry relies upon an explicit legal basis:
- Legitimate Interests (Art. 6(1)(f)): Processing diagnostic server logs to detect distributed denial-of-service attempts, preserve server infrastructure security, and debug rendering faults.
- Performance of Pre-contractual or Communicative Steps (Art. 6(1)(b)): Responding to user requests, itinerary clarification questions, or editorial feedback submitted through our contact forms.
- Explicit Consent (Art. 6(1)(a)): Running non-essential analytical cookies to measure readership metrics across individual scenic route field guides. Consent can be updated or withdrawn at any time using our cookie settings dialog.
- Legal Obligation (Art. 6(1)(c)): Retaining records where mandatory under Norwegian corporate, accounting, or tax law.
4. Third-Party Data Processors & Sub-Processors
Brightsrankpantry does not sell, lease, monetize, or trade your personal data. We engage contracted service providers (data processors) who handle data solely upon our documented instructions and subject to strict confidentiality agreements:
- Hosting & Server Infrastructure: Enterprise cloud datacenter hosting located within the European Economic Area (EEA), adhering to ISO/IEC 27001 standards.
- Transactional Email Services: Managed SMTP relays operating with TLS encryption in transit for routing contact inquiries.
- Privacy-Preserving Analytics: Aggregated, cookieless or consent-governed traffic auditing tools that do not engage in cross-site behavioral tracking.
5. International Data Transfers
All core databases and primary servers are hosted within the European Economic Area (Norway / EU member states). In the event that a service provider processes data outside the EEA in a territory not recognized by the European Commission as providing an adequate level of protection, transfers are executed pursuant to Standard Contractual Clauses (SCCs) approved by the European Commission, accompanied by supplementary technical security measures.
6. Data Retention Schedule
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:
- Contact inquiries: Retained for 180 days following resolution of the query, after which records are purged from mail server queues.
- Web server logs: Rotated and overwritten automatically every 30 days.
- Cookie consent selections: Stored locally in your client device browser storage for 365 days before requiring reaffirmation.
7. Data Subject Rights Under GDPR & CCPA
As a data subject, you maintain comprehensive statutory rights regarding your personal information:
- Right of Access (Art. 15 GDPR): You may request confirmation as to whether we process your data and receive a readable copy.
- Right to Rectification (Art. 16 GDPR): You have the right to correct inaccurate or incomplete personal details.
- Right to Erasure ("Right to be Forgotten", Art. 17 GDPR): You may request the deletion of your personal data where retention is no longer justified.
- Right to Restriction of Processing (Art. 18 GDPR): You may request that we temporarily suspend data processing while contesting accuracy or legality.
- Right to Data Portability (Art. 20 GDPR): You may receive your provided personal data in a structured, commonly used, machine-readable format.
- Right to Object (Art. 21 GDPR): You may object at any time to data processing carried out under legitimate interests.
- CCPA Non-Discrimination: California residents will never receive discriminatory pricing, altered service levels, or denial of access for exercising privacy rights.
8. Data Protection Officer (DPO) & Supervisory Contact
To exercise any of your data protection rights, lodge an inquiry, or submit a complaint, please direct communications to our designated privacy team at:
Data Protection Office — Brightsrankpantry Nordic Expeditions Ltd
Havnegata 14, 8300 Svolvær, Lofoten, Norway
Email: [email protected]
Attention: Privacy & Compliance Lead
You also have the right to lodge a formal complaint with the Norwegian Data Protection Authority (Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, Norway, website: datatilsynet.no) or your local European supervisory authority.