1. Who is responsible

Digital Solutions - De Barros, org. no. 996 041 468, a company registered in Norway and based in Larvik. It decides how data is processed and answers for it. Contact for any privacy matter: [email protected].

Boreal Saga Play is produced by Duna Press. Because the controller is in Norway, the GDPR applies through Norwegian data protection law. For readers in Brazil the LGPD applies as well. Both laws apply in parallel, and we follow the more protective one on each point.

2. What data we process

Newsletter. If you subscribe, we keep your email address, the language you chose, the date of sign-up, the date of confirmation and the version of the consent text you accepted. We do not store your IP address with the sign-up, and we do not ask for a name, a phone number or anything else.

Reading the site. Reading the stories and playing the games needs no sign-up. The games run in your browser and neither store nor send data.

Audience measurement. Google Analytics counts visits in aggregate, and only after you consent.

Advertising. The site shows Google AdSense ads, which may store identifiers in your browser, depending on the choice you make in the consent window.

Messages. If you write to [email protected], we use the message and your address only to reply and, where relevant, to correct the content.

We do not process sensitive data and we do not sell personal data.

3. Why we use it and on what legal basis

The basis for newsletter sign-up is your consent: you tick the consent box and confirm your email through the link we send (double opt-in). You can withdraw consent at any time, in one click, through the link at the bottom of every email. Withdrawal does not affect what was done before it.

Audience measurement and personalised advertising also depend on your consent. Service security rests on legitimate interest. Record keeping required by law rests on legal obligation.

4. Where the data lives and who handles it

The subscriber list is held in a database in Norway, on a Domeneshop server contracted by Digital Solutions. Messages are sent from that same infrastructure. The site is delivered by Cloudflare. These providers process data on our behalf and under contract.

Google (Analytics and AdSense) acts as an independent controller of the data it collects in your browser. Its processing follows Google’s own policies.

We do not hand the subscriber list to advertisers or to anyone else.

5. International transfers

Some providers, such as Cloudflare and Google, may process data outside Norway, the European Economic Area and Brazil. In those cases we rely on standard contractual clauses and safeguards compatible with the GDPR and the LGPD.

6. How long we keep it

Unconfirmed sign-ups are deleted within seven days. Confirmed subscribers stay on the list until they unsubscribe. Anyone who unsubscribes stops receiving mail and has their address deleted within thirty days, unless we need to keep the record of the unsubscription to prove it was honoured.

7. Your rights

You can ask for access to your data, correction, erasure, restriction, objection, portability and withdrawal of consent. Write to [email protected]. We answer within thirty days.

If you believe we have not respected your rights, you can complain to the Norwegian data protection authority (Datatilsynet) or, if you are in Brazil, to the ANPD.

8. Security

Communication with the site and the form is encrypted. Access to the subscriber database is restricted, and the confirmation and unsubscribe links are individual and cannot be guessed. If an incident carries a relevant risk, we will notify the people concerned and the authorities within the legal deadlines.

9. Changes

When this policy changes, the date at the top of the page changes too. Changes that affect your subscription will be announced by email.