Blue Biome – Privacy Policy

1. Introduction

Blue Biome is a nonprofit organisation registered in Norway, dedicated to advancing ocean literacy through educational games, digital resources, scientific knowledge, art, and collaborative learning activities.

We respect your privacy and are committed to protecting personal data in accordance with the European Union's General Data Protection Regulation (GDPR), as incorporated into Norwegian law, and other applicable data protection legislation.

This Privacy Policy explains:

• What personal information we collect.
• Why and how we use that information.
• The legal bases for processing personal data.
• Which external service providers may process information.
• How long we retain information.
• How we protect personal information.
• Your rights and how to exercise them.

We aim to collect only the information reasonably necessary to operate our activities and support our educational mission.

2. Who Is Responsible for Your Data?

The data controller for the personal information described in this policy is:

BLUE BIOME

• Organisation type: Nonprofit association registered in Norway
• Organisation number: 936 874 819
• Registered address: Vinddalsveien 20, 5106 Øvre Ervik, Norway
• Email: info@bluebiome.net
• Website: https://bluebiome.net

Blue Biome determines the purposes and means of processing personal information for activities under its responsibility.

For privacy-related enquiries, data access requests, or requests to exercise your rights, please contact info@bluebiome.net.

3. Scope of This Policy

This Privacy Policy applies to personal information processed through Blue Biome's activities, including:

• Our main website and online shop.
• The Blue Biome GIS and WebGIS applications.
• Online educational games and interactive tools.
• Educational resources, species catalogues, knowledge graphs, and digital exhibitions.
• Newsletter subscriptions and email communications.
• Customer purchases, payments, deliveries, refunds, and invoicing.
• Events, workshops, educational pilots, and collaborations organised by Blue Biome.

This policy does not govern independent websites or external services that determine their own processing purposes, even when they are linked from the Blue Biome website.

4. Personal Information We Collect

The information we process depends on how you interact with Blue Biome.

4.1 Website Usage and Technical Information

When you visit our website or use our digital applications, our systems and technical service providers may process:

• IP address and technical connection information.
• Browser type, operating system, and device characteristics.
• Pages visited and general usage activity.
• Date and time of access.
• Technical logs necessary for website operation, troubleshooting, and security.
• Cookie identifiers and similar information where the relevant technologies are used.

We may use aggregated reports to understand website usage and improve our educational services.

Although aggregated statistics may not identify individual users, the underlying technical or analytics information can constitute personal data.

We distinguish technical information necessary to operate and protect our services from optional analytics and advertising technologies.

4.2 Newsletter Subscriptions

If you voluntarily subscribe to Blue Biome updates, we collect:

• Email address.
• First name, if provided.
• Subscription and consent information.
• Subscription preferences.
• Email engagement information, such as opens and link clicks, where enabled and permitted.

This information is used to communicate about:

• Blue Biome board games and educational products.
• Marine ecology and ocean literacy resources.
• Project developments and collaborations.
• Educational events and opportunities.
• Crowdfunding campaigns and other initiatives supporting our nonprofit mission.

You can unsubscribe at any time.

4.3 Online Shop and Purchases

When you purchase a product directly from Blue Biome, we process information needed to complete the transaction, which may include:

• Customer name.
• Email address and contact information.
• Billing and shipping addresses.
• Products purchased, quantities, and order history.
• Payment references and transaction status.
• Shipping and delivery information.
• Invoice and accounting information.
• Correspondence relating to orders, returns, refunds, and complaints.

Payment information is processed through our selected payment service provider.

We do not need to retain complete payment-card numbers in Blue Biome's own order records.

4.4 Contact Forms and Direct Communications

When you contact us by email or through an online form, we may process:

• Your name and email address.
• Organisation or institutional affiliation, if supplied.
• The content of your message.
• Relevant correspondence and follow-up information.

We use this information to respond to enquiries and manage relevant communications.

4.5 Educational Games and Interactive Resources

Some Blue Biome tools may process technical or temporary session information to provide interactive functionality.

Depending on the specific application, this may include game preferences, session state, or information voluntarily submitted through an interactive feature.

Where a particular application collects additional personal information, such as account details, player identifiers, saved scores, or submitted content, Blue Biome will provide relevant information at the point of collection.

We aim to make educational resources accessible without requiring users to disclose unnecessary personal information.

4.6 Educational Activities, Workshops, and Collaborations

When collaborating with schools, museums, scientific institutions, artists, or community organisations, we may process:

• Names and professional contact details of participants or coordinators.
• Institutional affiliations.
• Workshop registrations and participation details.
• Feedback and evaluation responses.
• Photographs, audio recordings, or videos where appropriately authorised.
• Information voluntarily contributed to educational or collaborative activities.

Where possible, educational evaluations and published results will use anonymous or aggregated information.

5. Why We Process Personal Information

Blue Biome processes personal information only where there is a lawful basis under the GDPR.

Where we rely on legitimate interests, those interests include maintaining secure and functional services, responding to enquiries, coordinating educational activities, and supporting the administration of our nonprofit mission.

We assess those interests against the rights and reasonable expectations of the people concerned.

Information required to fulfil an order must be provided to complete the purchase. Optional information, such as newsletter subscriptions and certain educational feedback, is not required to purchase products or access unrelated services.

We do not use newsletter consent as a condition for purchasing products.

6. Cookies and Similar Technologies

Blue Biome may use cookies, local storage, and similar technologies to operate its website and provide interactive services.

These technologies fall into the following categories.

6.1 Strictly Necessary Technologies

These support essential functions such as website security, session management, shopping-cart operation, and recording privacy preferences.

Where these technologies are strictly necessary to provide a service requested by the user, they may be used without separate cookie consent, in accordance with applicable law.

6.2 Analytics Technologies

Analytics tools may help us understand how visitors use our website and educational resources.

Depending on the tools enabled, they may process usage events, identifiers, browser information, or other technical data.

Where analytics technologies require consent under applicable law, they will be activated only after valid consent has been obtained.

6.3 Advertising and Conversion Tracking

Blue Biome may promote its educational activities and products through external advertising platforms, including Google and social media services.

Running advertising campaigns does not necessarily mean advertising trackers are installed on our website.

If advertising pixels, remarketing technologies, conversion tracking, or comparable non-essential technologies are deployed, they will be disclosed and subject to the required consent controls.

6.4 Managing Cookie Preferences

Visitors must be able to accept or reject optional cookies and withdraw consent as easily as it was given.

Cookie preferences: [VERIFY AND INSERT COOKIE SETTINGS LINK OR CONTROL]

A description of the technologies actually used, including their providers, purposes, and retention periods, will be available through our cookie information or consent interface.

Cookie inventory: [VERIFY AND INSERT CURRENT COOKIE AND TRACKING INVENTORY OR A LINK TO IT]

Disabling optional cookies will not prevent access to basic website content, although certain optional features may be affected.

7. Newsletter and Email Communications

Blue Biome uses MailerLite to manage newsletter subscriptions and distribute email communications.

MailerLite processes relevant subscriber information on our behalf under the applicable service and data protection arrangements.

We use newsletter information for communications consistent with the purposes explained when you subscribe.

Your subscription is voluntary, and you may withdraw consent at any time by:

• Clicking the unsubscribe link in our emails.
• Contacting info@bluebiome.net.

Withdrawing consent does not affect processing that was lawful before withdrawal.

We may retain limited records necessary to document consent and honour unsubscribe requests where legally justified.

For further information about MailerLite's own data practices, see:

https://www.mailerlite.com/legal/privacy-policy

8. Payments, Orders, and Invoicing

Where direct online purchasing is available, payments are processed through Stripe and any other payment methods identified at checkout.

Stripe may process information necessary for payment authorisation, fraud prevention, transaction completion, and compliance with financial regulations.

Depending on its activities, Stripe may act as a data processor on our behalf or as an independent data controller for certain payment-related purposes.

Further information is available at:

https://stripe.com/privacy

Blue Biome may also process customer information to:

• Confirm and fulfil purchases.
• Prepare invoices, including EHF electronic invoices where applicable.
• Manage payments and refunds.
• Coordinate shipping.
• Respond to customer complaints.
• Meet applicable tax, accounting, and legal requirements.

Relevant information may be disclosed to invoicing providers, payment processors, accountants, shipping companies, or fulfillment partners where necessary for these purposes.

Customers purchasing directly from Blue Biome will not automatically be subscribed to promotional newsletters.

9. Schools, Children, and Educational Collaborations

Blue Biome develops educational resources intended for broad audiences, including schools and young learners.

We recognise that children's personal information requires particular care.

Our approach is to minimise personal data collection in educational activities wherever possible.

When working with schools or institutions:

• We aim to avoid collecting unnecessary identifiable information about students.
• Evaluation results may be collected anonymously or presented in aggregated form.
• Participation information is limited to what is necessary for the relevant activity.
• Roles and responsibilities for personal data are established with partners where appropriate.
• We seek appropriate permissions before using identifiable participant photographs, videos, or other personal materials in public communications.

Photographs or videos identifying children will not be published by Blue Biome without an appropriate lawful basis and the necessary parental or guardian permissions under applicable law.

We also take account of children's views and objections.

Teachers, schools, and collaborating organisations should not submit identifiable student information to Blue Biome unless there is an appropriate legal basis and the necessary arrangements are in place.

For privacy enquiries concerning children or school activities, contact info@bluebiome.net.

10. Sharing Personal Information

Blue Biome does not sell personal information.

However, we may disclose limited personal information to service providers and partners where necessary to operate our services and fulfil the purposes described in this policy.

These may include:

• MailerLite: Newsletter and email subscription management.
• Stripe: Payment processing and related financial services.
• Website hosting and technical service providers: Hosting, security, maintenance, and infrastructure.
• Analytics and advertising providers: Where relevant tools are deployed and permitted.
• Shipping and fulfillment partners: Delivery of products purchased from Blue Biome.
• Accounting and invoicing providers: Financial documentation and electronic invoicing.
• Educational or project partners: Information necessary for agreed collaborative activities, subject to appropriate arrangements.

We aim to disclose only information that is necessary for the relevant purpose.

Service providers acting as processors are required to handle information in accordance with applicable data protection obligations.

Where another organisation acts as an independent controller, its own privacy information may also apply.

Personal information may also be disclosed where required by law or a valid request from a competent authority.

11. External Websites and Third-Party Products

Our website may include links to independent educational products, publishers, retailers, research organisations, or external online services.

For example, certain books and other products may be featured on Blue Biome but sold directly through Amazon or another independent retailer.

When you follow an external link, the destination website may process information about your visit under its own privacy policy.

Blue Biome is not responsible for the privacy practices of external websites that operate independently of us.

We recommend reviewing their policies before supplying personal information.

Our website may also embed or link to content hosted on external platforms, including video and social media services.

Such integrations may involve the processing of technical information when the external content is loaded. Where this requires consent, appropriate controls must be applied.

12. International Data Transfers

Blue Biome is registered in Norway and collaborates with organisations and service providers in several countries.

Some external service providers or their subcontractors may process personal information outside the European Economic Area (EEA).

Where international transfers are subject to GDPR restrictions, Blue Biome will use an appropriate legal transfer mechanism, such as:

• A relevant adequacy decision.
• European Commission Standard Contractual Clauses, together with additional safeguards where necessary.
• Another transfer mechanism permitted by applicable law.

International transfer details: [VERIFY WHICH PROVIDERS TRANSFER PERSONAL DATA OUTSIDE THE EEA, THE RELEVANT COUNTRIES, AND THE SAFEGUARDS USED]

Information about applicable safeguards and how to obtain further details may be requested at info@bluebiome.net.

13. Data Retention

We retain personal information only for as long as necessary for its legitimate purpose or to comply with applicable legal requirements.

Our retention approach includes:

Newsletter Data

Subscriber information is retained while the subscription remains active.

When a person unsubscribes, we stop sending newsletter communications and remove or retain relevant information as necessary to honour the request and meet legal obligations.

Purchases and Accounting

Order, invoice, payment, and accounting information is retained for the applicable statutory period.

Where Norwegian bookkeeping rules apply, primary accounting documentation generally must be retained for five years after the end of the relevant financial year.

Certain information may be retained longer where required by law or necessary to resolve a legitimate legal claim.

Website Logs and Analytics

Technical logs and analytics information are retained only for the periods necessary for security, service operation, and the relevant analytics purposes.

Retention periods: [VERIFY AND INSERT ACTUAL SECURITY LOG AND ANALYTICS RETENTION PERIODS]

Correspondence

Enquiries and correspondence are retained for as long as reasonably necessary to address the request, manage the relevant relationship, or comply with legal obligations.

Correspondence retention: [VERIFY ACTUAL RETENTION CRITERIA OR PERIOD]

Educational Activities and Media

Participation information, evaluation material, photographs, and videos are retained in accordance with the specific purpose, lawful basis, and any applicable collaboration arrangements.

Project and media retention: [VERIFY ACTUAL RETENTION PERIODS OR CRITERIA]

Where processing is based on consent, individuals may withdraw that consent. We will assess the resulting deletion or cessation request in accordance with applicable law.

We periodically review retained information and delete or anonymise information no longer required.

14. Data Security

Blue Biome takes reasonable technical and organisational measures appropriate to the nature of the information processed and the risks involved.

These may include access controls, secure communications, restricted administrative permissions, and the use of established service providers with relevant security measures.

We aim to limit access to personal information to authorised persons who need it for legitimate organisational purposes.

No internet-based system can guarantee absolute security.

Where a personal data breach occurs, Blue Biome will assess and fulfil any applicable notification obligations.

15. Your Rights Under the GDPR

Subject to applicable conditions and exceptions, you have the right to:

• Access: Request information about personal data we process concerning you.
• Rectification: Request correction of inaccurate or incomplete information.
• Erasure: Request deletion of personal information where the legal conditions are met.
• Restriction: Request that certain processing be restricted.
• Data portability: Receive certain personal data in a structured, commonly used, machine-readable format where applicable.
• Objection: Object to processing based on legitimate interests, subject to the applicable rules.
• Withdraw consent: Withdraw previously given consent without affecting the lawfulness of earlier processing.
• Object to direct marketing: Object to the use of personal data for direct marketing.

To exercise your rights, contact:

info@bluebiome.net

We will respond without undue delay and normally within one month, subject to the GDPR rules on extensions and exceptions.

We may request information reasonably necessary to verify identity before disclosing personal data.

Certain information, including legally required accounting records, may need to be retained even when deletion is requested.

Automated Decision-Making

Blue Biome's educational and digital tools may use automated processing to provide interactive functions.

Such functionality is distinct from automated decision-making that produces legal or similarly significant effects on individuals.

[VERIFY WHETHER ANY SERVICE USES SOLELY AUTOMATED DECISIONS WITH LEGAL OR SIMILARLY SIGNIFICANT EFFECTS. IF NONE DO, STATE THIS EXPLICITLY.]

Right to Lodge a Complaint

If you believe that your personal data has been processed unlawfully, you may lodge a complaint with the relevant supervisory authority.

Blue Biome's Norwegian supervisory authority is:

Datatilsynet – Norwegian Data Protection Authority

https://www.datatilsynet.no

You may also have the right to complain to the competent data protection authority in another EEA country.

We encourage you to contact Blue Biome first so we can try to address your concerns.

16. Information Received from Partners

Sometimes schools, educational organisations, project partners, or collaborators may provide Blue Biome with professional contact details or participation information.

Where information is received from another organisation, we assess the relevant processing purpose, legal basis, and any additional transparency obligations.

The information may include names, institutional affiliations, contact details, or other data relevant to the specific collaboration.

We will provide additional privacy information directly to affected individuals where required by law.

17. Changes to This Policy

We may update this Privacy Policy to reflect changes in:

• Our educational activities and services.
• Our online shop and payment arrangements.
• Technical infrastructure and external service providers.
• Applicable legislation and data protection requirements.

The date of the latest revision will appear at the top of this policy.

Where a change materially affects how personal information is processed, we will provide additional notice when required by law.

The latest policy will remain available on our website.

18. Contact

For questions about this Privacy Policy or the processing of your personal information, please contact:

BLUE BIOME

Vinddalsveien 20 5106 Øvre Ervik Norway

Organisation number: 936 874 819

Email: info@bluebiome.net

Website: https://bluebiome.net

Blue Biome is committed to protecting privacy while making ocean literacy accessible through science, education, creativity, and collaborative learning.