This Privacy Policy explains how personal data is handled on theindiegamesroom.com, the website of Tafløy Lofoten Resort & Casino, a planned hotel and resort project on an island in Lofoten, Norway. The resort has not been built, and this website does not take bookings or sell anything. Its only feature that involves personal data is an interest list that you can join by email.
1. Who is responsible
The controller of your personal data is Anna Lupii, 10B Akademika Korolova Street, Kyiv, 02000, Ukraine (“we”, “us”). For anything related to this policy or to your personal data, write to [email protected]. Every message is read by a person, and we reply by email.
We are established outside the European Economic Area (EEA). Because this website is addressed to people in Norway and elsewhere in the EEA, we apply the General Data Protection Regulation (EU) 2016/679 (“GDPR”), as incorporated into Norwegian law by the Personal Data Act (personopplysningsloven), together with the Law of Ukraine “On Personal Data Protection”. Where Article 27 GDPR requires us to designate a representative in the EEA, we will do so and publish the representative’s details on this page.
2. The short version
- We only receive what you choose to send us: your name, your email address, the topic you are interested in and your consent.
- There are no analytics, advertising pixels, tracking scripts or cookies on this website.
- Fonts and images are served from this website itself, so your browser does not contact third-party servers when you visit.
- You can withdraw your consent at any time by writing to [email protected].
- We do not sell your data, and we do not share it with anyone for their own marketing.
3. What we collect and why
3.1 The interest list
The interest list form on the Contact page does not send anything by itself. When you press the button, the website checks the form in your browser and opens your own email app with a pre-written message to [email protected]. Nothing reaches us unless you send that email yourself. The message contains:
- your name;
- your email address;
- the topic you chose, for example a type of room, the Games Room, gatherings or general news;
- a sentence confirming that you agree to receive news about the project.
We use this information to keep a list of people who want to hear about the project, and to write to you when there is news worth sending: for example a confirmed opening date, the opening of reservations or a significant change to the plans. We will not send frequent newsletters, and we will not pass your address to anyone else for their own purposes.
Legal basis: your consent under Article 6(1)(a) GDPR. Because these messages are electronic marketing, sending them also requires your prior consent under section 15 of the Norwegian Marketing Control Act (markedsføringsloven). The checkbox in the form and the confirmation sentence in your email record that consent.
3.2 Other emails you send us
If you write to any of our addresses (info@, events@, privacy@ or [email protected]), we receive your email address, your name if you include it, and whatever you choose to write. We use this to answer you and to keep a record of the conversation.
Legal basis: our legitimate interest in replying to the messages we receive (Article 6(1)(f) GDPR) and, where your message concerns your data protection rights, our legal obligation to respond (Article 6(1)(c) GDPR).
3.3 Technical logs
Like any website, this one is delivered by a web server. When your browser requests a page, the hosting provider’s servers may record technical data in log files: your IP address, the date and time of the request, the page or file requested, the browser’s user-agent string, the referring page and the response code. These logs are used only to deliver the website, keep it secure and investigate faults or misuse. They are not combined with the interest list and are not used to build profiles.
Legal basis: our legitimate interest in operating a secure and reliable website (Article 6(1)(f) GDPR). Logs are deleted automatically according to the hosting provider’s retention schedule, which we keep as short as practical.
3.4 What we do not collect
This website has no analytics, advertising or social media plugins, visitor counters, pixels or tracking scripts, and it sets no cookies. The games-evening planner, the room viewer and the gallery work entirely in your browser and store nothing. The only item this website may store on your device is a small display preference, described in our Cookie Policy.
4. Who receives your data
We do not sell your personal data, and we do not share it with anyone for their own purposes. It may be processed on our behalf by:
- the provider that hosts this website, for the technical logs described above;
- the provider of our email service, which stores the messages you send us and our replies;
- if we later use a dedicated service to send updates to the interest list, the provider of that service.
These providers act as processors under written agreements that meet the requirements of Article 28 GDPR. We will name them on request, and we will update this section when a service for sending updates is chosen. We may also disclose data where the law requires it, for example to a court or public authority acting within its powers.
5. International transfers
We are established in Ukraine, and some of our service providers may process data outside the EEA. Ukraine does not currently benefit from an adequacy decision of the European Commission. Where personal data is transferred from the EEA to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (Article 46(2)(c) GDPR), together with any additional measures needed to protect the data. You can ask for a copy of the relevant safeguards by writing to [email protected].
6. How long we keep your data
- Interest list: until you withdraw your consent or the project is abandoned. We review the list at least once a year, and entries older than three years are deleted unless you have confirmed that you still want to hear from us.
- Other emails: for as long as needed to deal with your message and then for up to three years, in case of follow-up questions or legal claims, unless the law requires a longer period.
- Record of withdrawal: if you ask to leave the interest list, we keep a minimal note of your email address and the date, so that we do not contact you again by mistake.
- Technical logs: according to the hosting provider’s retention schedule, as described in section 3.3.
7. Withdrawing your consent
You can withdraw your consent at any time by writing to [email protected], ideally from the address you want removed. Withdrawal does not affect the lawfulness of anything we did before it. These requests are handled by hand: we will confirm by email once your details have been removed from the interest list, and we aim to do so within a few working days and in any case within one month.
8. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- get access to the personal data we hold about you and a copy of it (Article 15);
- have inaccurate data corrected (Article 16);
- have your data erased (Article 17);
- have the processing restricted in certain cases (Article 18), and be told about corrections, erasure or restriction passed on to others (Article 19);
- receive the data you gave us on the basis of consent in a structured, commonly used format (Article 20);
- object at any time to processing based on our legitimate interests (Article 21);
- not be subject to decisions based solely on automated processing (Article 22). We make no such decisions.
To exercise any of these rights, write to [email protected]. We may ask for information to confirm your identity before acting on a request. We will reply within one month, which may be extended by two further months for complex requests as allowed by Article 12(3) GDPR. Exercising your rights is free of charge.
9. Complaints
If you think we have handled your data unlawfully, we would like to hear from you first so that we can put it right. You also have the right to lodge a complaint with a supervisory authority, in particular:
- Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no);
- the Ukrainian Parliament Commissioner for Human Rights, which supervises personal data protection in Ukraine (ombudsman.gov.ua);
- the supervisory authority of the EEA country where you live or work, or where you believe the problem occurred.
10. Age
This website and the interest list are intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe that someone under 18 has sent us their details, please write to [email protected] and we will delete them.
11. Security
The website is served over an encrypted connection and uses a strict Content Security Policy that prevents third-party scripts from running. Access to the interest list is limited to the people who need it to handle the project’s communications, and we use appropriate technical and organisational measures to protect it. No method of transmission or storage is completely secure, and email in particular may pass through several servers before it reaches us.
12. Changes to this policy
We will update this policy whenever the way we handle personal data changes, for example if a service for sending updates is added or if the resort starts taking reservations. The date at the top of the page shows the current version. If a change affects how we use data you have already given us, we will tell you by email before it takes effect.