Legal / Privacy Policy
Privacy Policy
How BrightMint Agency LTD handles personal data on brightmintagency.com.
Controller
The controller is BrightMint Agency LTD, represented for this site by Dorothy Dawson, 123 Buckingham Palace Road, London SW1W 9SH, United Kingdom. Editorial mail: dorothyda@brightmintagency.org.
This website is not operated by Color Line AS, Color Fantasy, Color Magic or Paf. A message sent here reaches a London publisher, not the Hjortnes concierge desk and not the casino on deck 6.
If you write about an Oslo–Kiel sailing, still address the British company by name. Putting “Color Line” or “Paf” in the subject line does not route the mail to those operators.
Providers who host the pages or the mailbox act on our instructions as processors. They are not joint controllers of this guide and they are not the shipowner. A summary of the processing terms is available on request to the editorial inbox.
Scope
These rules cover the informational pages in English and Norwegian, the inquiry and contact forms, the age-confirmation stored in your browser, and the cookie choice recorded after the banner.
They do not cover colorline.com, colorline.no, Paf sites, Google Maps, web-font networks, or any booking engine you open in a new tab. Those services publish their own notices.
English is the primary language of the guide; Norwegian Bokmål is offered so readers in Norway can read the same facts. Both language versions sit under this policy. Switching language by URL does not create a separate controller.
Fonts, the GSAP animation library and the map embed on the Location page are described in the Cookie Policy. Once those resources load, any processing they perform is that of their providers, not a cabin reservation system.
Data we collect
If you submit a form we receive the fields you type: name, email, optional telephone, sailing dates, guest count, direction (Oslo–Kiel or Kiel–Oslo), cabin preference and message, plus the consent tick. We do not require an account and we do not ask for payment-card numbers.
Server logs may include IP address, browser type, language and the URL you requested. We use those logs to keep the host secure and to diagnose faults, not to build a marketing profile of ferry guests.
We do not ask for nationality, passport numbers, Color Line booking references, loyalty-programme identifiers, or a history of play. If you type those details into the free-text box unsolicited, we still treat them as part of your message and delete them when the correspondence ends, unless a legal hold applies.
We do not run account registration, newsletters, or a logged-in “my sailings” area. There is therefore no customer profile that follows you from visit to visit besides the age and cookie flags described elsewhere.
Inquiry forms
Forms are reservation inquiries or editorial messages. Sending one does not create a ferry contract, a confirmed fare or a casino booking. We use the data solely to reply and, where useful, to point you to official Color Line channels.
Please do not attach identity documents, boarding passes or copies of passports. If a message is abusive, empty or clearly automated we may delete it without a reply.
The booking form may include check-in style dates, guest count and a preferred cabin category. Those fields help us answer; they do not reserve a cabin on Color Fantasy or Color Magic and they are not passed automatically to Color Line’s engine.
The contact form is for editorial questions: corrections, language, or how this independent guide works. Operational requests (late boarding, table hold, spa slot, vehicle check-in) belong on Color Line’s published phones and sites.
Cookies
We store an age-gate acknowledgement and a cookie-preference flag in local storage on your device so the overlays do not return on every page load. The keys are bm-age and bm-cookie.
Optional analytics run only if you accept them on the banner. The Cookie Policy lists categories, durations and how to withdraw that choice.
The flags live only on your device. We do not read them from another computer or stitch them to your email address unless you later write to us and mention the same browser choice.
Language is not stored as a cookie. You choose English at the site root or Norwegian at /no/. Returning to the other URL is enough to change language; no extra tracking file is required for that switch.
Legal bases
UK GDPR and the Data Protection Act 2018 apply to this publisher. Replying to a request you sent us: Article 6(1)(b) where steps toward a publisher service are requested or, where no contract is forming, Article 6(1)(f). Legal duties such as keeping a complaint long enough to defend a claim: Article 6(1)(c).
Optional analytics: Article 6(1)(a) consent. Legitimate interests also cover keeping the site secure and remembering that you passed the 18+ gate on this device, which is a lighter interference than asking you on every visit.
Where we rely on legitimate interests, those interests are: answering a person who wrote to us, keeping a small independent site available without repeating legal overlays, and defending the publisher if a message is later disputed.
You may object to processing based on legitimate interests. We will stop unless we demonstrate compelling grounds or need the data to establish, exercise or defend a legal claim. Consent for optional analytics is separate and can be withdrawn at any time.
Recipients
Hosting and email infrastructure providers act as processors under contract. They may see the technical data needed to deliver mail and pages. They are not authorised to use your inquiry to sell cabins or casino packages.
We do not sell personal data. We do not forward your inquiry to Color Line AS or Paf unless you ask us in writing to do so and we agree.
We do not disclose inquiry contents to advertising networks, data brokers, or gambling marketing lists. Staff of the publisher who need the message to draft a reply may read it.
If a competent authority in the United Kingdom or another state lawfully requires disclosure, we will limit what we hand over to what the request covers and will tell you unless the law forbids notice.
Retention
Inquiry emails are kept only as long as needed to finish the correspondence and any limitation period that reasonably applies, then deleted or archived with restricted access.
Age and cookie flags remain in your browser until you clear site data. Server logs are rotated on a short cycle measured in weeks, not years, unless a security incident requires a longer hold.
If you ask us to delete a message sooner, we will, unless we must keep a copy to handle a complaint, a security incident, or a legal obligation. We will say so if we refuse a deletion request.
Backups of the host, if any, expire on the host’s rotation. We do not build a permanent “passenger book” of everyone who planned an Oslo–Kiel crossing through this form.
International transfers
The publisher is established in the United Kingdom. If you write from the EEA or Norway, your message is transferred to the UK so we can read it and reply.
We rely on the UK’s adequacy status where it applies. If a processor stores data in a country without an adequacy decision we use standard contractual clauses and any extra safeguards the clauses require.
Mail travelling over the public internet may transit networks outside the UK even when the mailbox is administered in London. We use encrypted transport where the service offers it.
We do not sell or rent the inquiry list to operators in Norway, Germany or elsewhere. A transfer happens only where a processor or a legal duty requires it, under the safeguards named above.
Security
We apply reasonable technical and organisational measures: HTTPS in production, restricted access to the editorial inbox, and no request that you send payment cards to this publisher.
No internet transmission is perfectly secure. If you believe a message to us was intercepted, write again from a new channel and say so.
Access to the editorial inbox is limited to people who need it for replies. We do not publish a public archive of submitted forms.
If we become aware of a breach likely to result in a high risk to your rights, we will notify you and the competent authority as UK GDPR requires. Do not send passwords, one-time codes or card CVV numbers to this address.
Your rights
You may request access, rectification, erasure, restriction, portability and objection. You may withdraw consent for optional analytics without affecting processing that was lawful before the withdrawal.
You may complain to the UK Information Commissioner’s Office (ico.org.uk). EEA or Norwegian residents may also contact their local supervisory authority, including Datatilsynet in Norway if that is more convenient.
To exercise a right, write from the email address you used on the form, or otherwise help us identify the correspondence. We may ask for limited extra information if several people share a name.
We will answer without undue delay and within one month, extendable by two months for complex or numerous requests, as UK GDPR allows. There is no fee unless a request is manifestly unfounded or excessive.
Children
Casino pages are written for adults. Color Line publishes an 18-year age limit for the onboard casino. We do not knowingly collect data from children in order to plan under-age gambling.
The on-site age gate is a control of this website, not a substitute for parental responsibility and not a check performed by Color Line or Paf at the salon door.
A parent or guardian who believes a child submitted a form should email us. We will delete the message unless a legal duty requires a short hold, and we will not use it to market a sailing.
Color Line’s own child-travel rules (children under 16 cannot travel alone; a 2-day cruise has a 20-year age limit) are operator rules. They are not a processing purpose of this publisher.
Third-party sites
Outbound links to Color Line, Paf, Lotteritilsynet, Hjelpelinjen, Google Maps and font CDNs are not covered by this notice. Following those links is your choice.
When you open an official booking engine or a map, you leave our controller relationship. Read the notice on that site before you type card details, a vehicle registration or a passport number.
Official sources we cite include colorline.com, colorline.no, aboutpaf.com, lovdata.no and lottstift.no. Each has a controller of its own.
We are not responsible for how those sites store card data, booking numbers or ID scans. Read their notices before you pay or upload a document.
Automated decisions
We do not carry out profiling that produces legal effects concerning you. There is no automated “accept or refuse cabin” engine on this domain.
The age gate and cookie banner are simple flags you set. They do not score credit, nationality or a gambling profile.
Form validation (required fields, email format) is a technical check in your browser and on submit. It does not decide whether you may sail with Color Line.
We do not use the inquiry to score a “high roller” or to refuse a later message automatically. Repeat abuse may be blocked by the host as traffic, not as a personalised legal decision.
Changes
We may update this policy when the site, the law or our processors change. Unless a revision date is marked, treat the footer year together with the text you are reading as the current version.
Material changes will appear on this page. We will not hide a new purpose inside a footnote. If consent is required for a new optional tool, the banner will ask again.
A change of processor, mailbox provider, or analytics tool is a material change if it alters who can see your data or for how long. We will describe that on this page.
Editorial rewrites of hotel copy, new photographs, or a new FAQ entry are not, by themselves, a change of this privacy policy.
Contact
Privacy requests: dorothyda@brightmintagency.org. Postal address: BrightMint Agency LTD, 123 Buckingham Palace Road, London SW1W 9SH, United Kingdom, for the attention of Dorothy Dawson.
Ship operations, cabin holds and casino doors are not handled at that address. Use the telephone numbers Color Line publishes (+47 22 94 42 00 for booking; +47 22 94 44 00 for reception at Hjortnes) for stay or admission questions.
When you write, state whether the request is access, deletion, a correction of facts on the guide, or a complaint. That helps us answer the right question first.
We will not pretend to be Color Line’s data protection officer or Paf’s privacy desk. Those organisations publish their own contacts.