Draft for legal review. The publisher is established in Norway and subject to the GDPR through Norwegian data protection law, while also processing data of readers in Brazil covered by the LGPD. Both apply in parallel.

1. Controller

Digital Solutions - De Barros, org. no. 996 041 468, registered in Norway, based in Larvik. Privacy contact: privacidade@borealtimes.org.

2. What we process

Subscribers. Email, subscription status and access records. Billing is processed by the App Store or Google Play — we neither receive nor store payment details.

Browsing. IP address, device type and pages visited, in aggregate form, only with consent.

Advertising. Google AdSense may store identifiers in your browser to cap repetition, measure performance and, with your permission, personalise what is shown. The choice is made in the consent window and can be changed at any time.

We process no special-category data and do not ask subscribers about their assets.

3. Purposes and legal bases

Performance of the contract: delivery, authentication, billing and support. Legal obligation: retention of records and tax documents for the periods required in Norway and, where applicable, Brazil. Legitimate interest: service security. Consent: audience measurement and promotional email, revocable at any time.

4. Processors and sharing

Cloudflare (hosting and protection) and Google Analytics where permitted act as processors. Apple and Google, for app subscription billing, and Google AdSense, for advertising, act as independent controllers of the data they collect at that step — their processing is governed by Google’s and Apple’s own policies.

We do not sell personal data and we pass none of our data to advertisers.

5. International transfers

Data may be processed outside Norway and outside Brazil. Where that happens we rely on standard contractual clauses and a transfer assessment consistent with the GDPR and the LGPD.

6. Retention

Subscription: for the life of the relationship and the accounting periods required afterwards in Norway. Access logs: six months.

7. Your rights

Access, rectification, erasure, restriction, objection, portability and withdrawal of consent. Requests go to privacidade@borealtimes.org and are answered within thirty days.

Complaints may be made to the Norwegian Data Protection Authority (Datatilsynet) or, for data subjects in Brazil, to the ANPD.

8. Security

Encrypted transport, sessions with no stored password, restricted access to the subscriber base and logging of administrative access. Incidents carrying material risk are reported to data subjects and to the competent authorities within statutory deadlines.

9. Protection of sources

Communications from journalistic sources are handled separately and never enter the subscriber or marketing base. Source confidentiality is protected under Norwegian law and, for Brazilian sources, by article 5, XIV of the Brazilian Constitution.