1. Data Controller Identification

The data controller responsible for the processing of your personal information is Brightspickledger Arctic Logistics AS, registered under Norwegian enterprise organization number Org nr 931 482 105 MVA, with registered corporate offices at Polarmiljøsenteret, Hjalmar Johansens gate 14, 9007 Tromsø, Norway. Inquiries regarding data processing should be directed to our designated Data Protection Liaison at [email protected].

2. Information Collection and Categories

We collect personal information through voluntary submission via our contact forms and automated server telemetry. This includes:

  • Voluntarily Disclosed Data: When you submit an expedition inquiry, we collect your name, operational organization, contact email address, subject classification, and the textual content of your dispatch.
  • Technical and Device Metadata: When you access this website, our hosting servers automatically log standard web parameters including your internet protocol (IP) address, browser version, operating system identifier, referring URL strings, and access timestamps.
  • Cookie and Local Storage Information: Details regarding operational tokens stored locally on your device to remember user interface preferences and consent declarations, as detailed in our Cookie Policy.

3. Legal Bases for Data Processing

Brightspickledger processes your personal information in strict conformity with Regulation (EU) 2016/679 (General Data Protection Regulation or GDPR) and the Norwegian Personal Data Act (Personopplysningsloven). Processing is conducted under the following legal bases:

  • Article 6(1)(b) GDPR (Contractual and Pre-contractual): Processing inquiries submitted through the contact portal necessary to provide logistical quotes, advice, or operational data.
  • Article 6(1)(f) GDPR (Legitimate Interests): Processing server diagnostic logs to defend against distributed denial-of-service (DDoS) incursions, maintain cryptographic integrity, and diagnose site performance.
  • Article 6(1)(a) GDPR (Consent): Processing analytical or functional cookies based upon your explicit selection through our cookie consent mechanism.

4. Third-Party Processors and Data Transfers

Brightspickledger does not sell, rent, or lease personal data to commercial marketers. Data may be processed by vetted infrastructure partners acting under strict Data Processing Agreements (DPAs) solely for:

  • Cloud hosting and network content distribution within European Economic Area (EEA) server regions.
  • Transactional email delivery gateways adhering to European standard contractual clauses (SCCs).

If data must be transferred outside the EEA, adequate safeguards such as European Commission Standard Contractual Clauses or equivalent adequacy decisions are verified before transmission.

5. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the operational purposes for which it was assembled:

  • Contact Inquiries: Communications sent via contact forms are retained for twenty-four (24) months to facilitate continuous expedition planning cycles and regulatory archiving, after which they are systematically purged.
  • Server Access Logs: Server logs containing IP addresses are retained for security auditing for a maximum of ninety (90) days before automated deletion.

6. Your Statutory Rights (GDPR and CCPA)

Subject to applicable data protection laws, visitors retain unambiguous rights concerning their personal data:

  • Right of Access: You may request confirmation of whether personal data concerning you is processed and receive a readable copy.
  • Right to Rectification: You may request corrections to inaccurate or incomplete information.
  • Right to Erasure ("Right to be Forgotten"): You may request the immediate deletion of personal data when it is no longer required for its original purpose.
  • Right to Restriction of Processing: You may request that processing operations be temporarily suspended during dispute resolution.
  • Right to Data Portability: You may receive your data in a structured, commonly used, machine-readable format.
  • Right to Object: You may object at any time to processing grounded upon legitimate interest justifications.

To exercise any of these protections, submit your signed request to [email protected]. You also retain the statutory right to file a formal complaint with the Norwegian Data Protection Authority (Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, Norway).