BB26: Privacy notice

Last updated: 25.07.2026

This privacy notice explains how Polar Bears Adventures collects, uses, stores and shares personal data in connection with Baltic Bangers 2026, our website and related communications.

We aim to process only the information we need, use it only for clearly defined purposes and keep it only for as long as necessary.

1. Who is responsible for your personal data?

Polar Bears Adventures is the data controller for the processing described in this privacy notice.

Organisation: Polar Bears Adventures
Organisation number: 994 893 866
Postal address: Øygardsbakken 9 B, 4327 Sandnes
Email: privacy@polar-bears.no
Website: www.polar-bears.no

Questions about this privacy notice or our processing of personal data may be sent to privacy@polar-bears.no.

2. Who does this notice apply to?

This notice applies to:

people registering for or participating in Baltic Bangers 2026;
participants included in a registered crew;
emergency contacts provided by participants;
people who communicate with the organisers;
people who submit photographs, video, written material or other challenge evidence; and
visitors to our website.

3. Personal data we collect

Depending on how you interact with us, we may process the following information.

Registration and participant information

name;
telephone number;
email address;
date of birth;
nationality;
crew name and crew membership;
vehicle make, model, registration number and other vehicle information;
driving licence or eligibility information, where required;
dietary, accessibility or other practical requirements voluntarily disclosed to us;
emergency contact name and telephone number; and
information supplied through the registration process.

Please do not provide health information or other sensitive personal data unless it is genuinely necessary for us to make practical arrangements for your participation.

Event administration and communications

emails, messages and other communications with the organisers;
attendance and participation information;
bookings, payments, refunds and transaction references;
challenge submissions and supporting evidence;
scores, awards, penalties and decisions made by the organisers;
incident reports, complaints and dispute correspondence; and
photographs, video, audio or written accounts submitted to us.

Website information

When you visit our website, we may process limited technical information such as:

IP address;
browser and device information;
operating system;
pages visited;
date and time of access;
referring website;
cookie identifiers; and
security and server logs.

The website uses Google Analytics 4 with Google Consent Mode to measure traffic. Analytics cookies are only set, and cookie-based analytics data only collected, if you agree to this through the cookie consent banner. Without your consent, only cookieless, aggregated signals with consent marked as denied are sent.

4. Where we obtain personal data

We normally obtain personal data directly from you when you:

register for the event;
join a crew;
communicate with the organisers;
submit evidence or other material;
make a payment;
complete a survey; or
use our website.

A crew organiser may provide information about other participants in the crew. The crew organiser must ensure that those participants know that their information has been provided and have access to this privacy notice.

Emergency contact details are normally provided by a participant. We ask participants to inform their emergency contact that their details have been given to us.

5. Why we process personal data

We process personal data for the following purposes.

Registration and delivery of the event

We use registration and participant information to:

process registrations;
confirm eligibility;
organise crews;
communicate practical information;
administer payments and refunds;
provide roadbooks, briefings and event materials;
manage rendezvous and event logistics;
answer participant questions; and
otherwise deliver Baltic Bangers 2026.

Legal basis: The processing is necessary to enter into or perform the participation agreement with you.

Safety, incident handling and emergency coordination

We may use participant, vehicle, emergency contact and communication information to:

respond to reported incidents;
contact an emergency contact where reasonably necessary;
coordinate practical assistance;
document safety-related matters; and
cooperate with emergency services or public authorities.

Legal basis: Our legitimate interests in protecting participants, managing the event responsibly and handling incidents. In a genuine emergency, processing may also be necessary to protect a person’s vital interests.

Participant communication

We use contact information to send information directly connected with registration and participation, including:

confirmations;
practical updates;
route or schedule changes;
challenge information;
safety messages;
payment information; and
post-event administrative messages.

Legal basis: The processing is necessary to perform the participation agreement.

Challenge administration and scoring

We process submissions, evidence, communications and relevant event information to:

receive and assess submissions;
verify completed objectives;
calculate scores;
publish standings;
issue awards or penalties;
resolve scoring questions; and
document event results.

Legal basis: The processing is necessary to perform the participation agreement and our legitimate interests in administering the event consistently and resolving disputes.

Photographs, video and submitted material

Participants may submit photographs, video, audio, written accounts and other material as challenge evidence.

We process this material to administer and score the event.

Legal basis: The processing is necessary to perform the participation agreement.

We will seek separate permission before using identifiable submitted material for unrelated advertising or future promotional campaigns, unless another lawful basis clearly applies.

Participants are responsible for considering the privacy of people appearing in their submissions. Do not submit material recorded unlawfully or in circumstances where publication or sharing would be inappropriate.

Event documentation and limited publication

We may publish limited event information such as:

crew names;
scores and standings;
awards;
challenge results;
event photographs;
route summaries; and
accounts of the event.

Legal basis: Our legitimate interests in documenting the event, communicating results and maintaining the event community.

We will consider the privacy interests of the people involved before publishing identifiable or potentially sensitive material. You may object to a particular publication by contacting us.

Accounting and legal compliance

We process payment, registration and transaction information where necessary to:

maintain accounting records;
document income and expenditure;
comply with tax, bookkeeping and other legal obligations;
respond to lawful requests from authorities; and
establish, exercise or defend legal claims.

Legal basis: Compliance with legal obligations and our legitimate interests in protecting our legal position.

Security and misuse prevention

We may process technical logs, account information and communications to:

secure our systems;
control access;
detect misuse;
investigate technical problems;
prevent unauthorised access; and
document security incidents.

Legal basis: Our legitimate interests in maintaining secure and reliable services and protecting participants and our organisation.

Surveys and feedback

We may invite participants to complete post-event surveys.

Where a survey is anonymous, we do not seek to identify respondents. Where responses are identifiable, we use them to evaluate and improve future events.

Legal basis: Our legitimate interests in evaluating and improving Baltic Bangers. Participation in surveys is voluntary.

Marketing and information about future events

We will only send marketing or information about unrelated future events where we have a valid legal basis to do so.

Where required, we will ask for separate consent. You may unsubscribe at any time.

Operational messages about an event for which you are registered are not marketing messages.

6. Our legitimate interests

Where we rely on legitimate interests, those interests may include:

organising and administering the event;
communicating with participants;
maintaining safety and handling incidents;
preventing misuse and securing our systems;
documenting results;
managing disputes and legal claims;
evaluating and improving future events; and
protecting Polar Bears Adventures, participants and third parties.

Before relying on legitimate interests, we consider whether the processing is necessary and whether the interests, rights and reasonable expectations of affected individuals outweigh our interests.

You may request further information about a relevant legitimate-interest assessment by contacting privacy@polar-bears.no.

7. When providing information is required

Some personal data is required for us to register you and deliver the event, including basic identity, contact, crew and payment information.

If required information is not provided, we may be unable to complete your registration or provide the relevant service.

Participation in the following activities is optional:

marketing communications;
surveys;
optional analytics cookies on our website; and
promotional use of identifiable submitted material where separate permission is required.

Refusing an optional activity will not prevent you from participating in the event.

We do not sell personal data.

We may share personal data with the following recipients where necessary.

Other registered participants

Depending on your choices and participation, other registered participants may receive or access:

your crew name;
event scores and standings; and
challenge submissions intended for shared judging or publication.

Service providers

We may use service providers for:

registration and ticketing;
payment processing;
email and participant communication;
website hosting;
cloud storage;
forms and surveys;
accounting;
IT support; and
data backup and security.

Current or expected providers include:

Ticketing provider: Checkin AS, Norway
Payment provider: Checkin AS, Norway
Email provider: Google, Ireland
Website hosting provider: Google, Ireland (Firebase Hosting)
Cloud or database provider: Google, Ireland
Survey or form provider: Google, Ireland
Web analytics provider: Google Ireland Limited, Ireland (Google Analytics)

Service providers acting on our behalf may process personal data only according to our instructions and applicable data-processing agreements.

Some providers, such as payment institutions, may act as independent data controllers for parts of their processing. Their own privacy notices will then apply.

Authorities and emergency services

We may disclose information where:

required by law;
necessary to respond to a lawful request;
necessary to protect a person’s vital interests;
required to report or manage a serious incident; or
necessary to establish, exercise or defend a legal claim.

Professional advisers

We may share relevant information with accountants, auditors, insurers, lawyers or other professional advisers where reasonably necessary.

9. Transfers outside the EEA

We aim to use providers that process personal data within Norway or the European Economic Area.

Some service providers may process or make personal data accessible from countries outside the EEA.

Where such a transfer occurs, we will ensure that an appropriate transfer mechanism is used, such as:

an adequacy decision adopted by the European Commission;
approved Standard Contractual Clauses;
another transfer mechanism permitted by GDPR; and
supplementary safeguards where required.

Further information about relevant transfers and safeguards may be requested from privacy@polar-bears.no.

10. How long we keep personal data

We retain personal data only for as long as needed for the purpose for which it was collected, or for a longer period where required by law or necessary to handle a dispute or legal claim.

Our expected retention periods are:

Information	Normal retention period
Registration and crew information	Normally not deleted
Payment and accounting information	For the period required by applicable bookkeeping and tax legislation
Routine participant communications	Normally not deleted
Incident, complaint and dispute records	Until the matter is resolved and any relevant limitation period has expired
Emergency contact information	Deleted or anonymised after the event and related incident handling is complete
Challenge submissions and scoring records	Normally not deleted
Marketing consent	Until consent is withdrawn or the information is no longer needed
Website security logs	Normally 180 days, unless needed to investigate an incident

Information may be retained beyond the stated period where necessary to comply with a legal obligation, resolve an active dispute or establish, exercise or defend a legal claim.

11. How we protect personal data

We use reasonable technical and organisational measures appropriate to the nature and risk of the processing.

These measures may include:

access controls;
individual user accounts;
authentication;
encryption in transit;
restricted administrative access;
separation of public and private information;
backups;
software updates;
logging and monitoring;
data-processing agreements;
deletion and anonymisation routines; and
limiting access to people who need the information for their role.

No service can be guaranteed completely secure. Participants should avoid sending unnecessary sensitive information through ordinary email or group messaging services.

If we become aware of a personal data breach, we will assess and handle it in accordance with applicable law. Where required, we will notify the Norwegian Data Protection Authority and affected individuals.

12. Your rights

Depending on the circumstances and legal basis, you may have the right to:

receive information about how we process your personal data;
obtain confirmation of whether we process data about you;
request a copy of your personal data;
correct inaccurate or incomplete information;
request deletion;
request restriction of processing;
object to processing based on legitimate interests;
receive certain information in a structured, commonly used and machine-readable format;
have certain information transferred to another controller;
withdraw consent at any time; and
complain to a data protection authority.

These rights are not absolute. For example, we may need to retain information to comply with legal obligations or deal with legal claims.

To exercise your rights, contact:

privacy@polar-bears.no

Please explain what your request concerns. We may ask for information necessary to confirm your identity before releasing or changing personal data.

We will respond without undue delay and normally within one month. The period may be extended where permitted by law for complex or numerous requests.

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect processing that lawfully took place before consent was withdrawn.

Marketing

You may withdraw marketing consent by using the unsubscribe function in the relevant message or contacting us.

Analytics cookies

You may withdraw your consent to analytics cookies at any time using the “Cookie settings” link in the footer of every page on this website. See section 15 for details.

14. Complaints

Please contact us first if you believe we have processed your personal data incorrectly. We would prefer the opportunity to investigate and correct the matter before anyone has to sharpen the regulatory stationery.

You also have the right to complain to the Norwegian Data Protection Authority:

Datatilsynet
Postboks 458 Sentrum
0105 Oslo
Norway

You may also complain to the supervisory authority in the EEA country where you live, work or believe an infringement occurred.

15. Cookies and website technologies

Our website may use cookies or similar technologies for:

essential website functions;
security;
remembering user choices;
traffic measurement;
embedded registration forms, maps, video or other third-party content;
web fonts (Adobe Fonts / Typekit); and
optional analytics.

Strictly necessary cookies may be used without consent where permitted by law. Non-essential cookies or similar tracking technologies will only be activated where the required consent has been obtained.

The signup page loads the registration and payment service from Checkin AS, which is necessary to register for the event. Checkin’s own privacy notice applies to the information you enter there.

Details of the cookies currently used:

Cookie	Provider	Purpose	Duration
klaro	This website	Stores your cookie consent choices (strictly necessary)	180 days
_ga	Google Analytics	Distinguishes visitors for traffic measurement	Up to 24 months
ga*	Google Analytics	Keeps session state for traffic measurement	Up to 24 months

The Google Analytics cookies are only set after you have given consent. Without consent, Google Analytics runs in cookieless mode with all consent signals set to denied (Google Consent Mode).

You can change or withdraw optional cookie choices at any time using the “Cookie settings” link in the footer of every page on this website.

16. Automated decision-making

We do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects.

Challenge scoring may involve calculations or digital tools, but final event decisions remain subject to review by the organisers.

17. Personal data relating to other people

Do not provide personal data about another person unless:

it is necessary;
you are authorised to provide it; and
the person has been informed about the relevant processing.

This applies particularly to:

other participants in your crew;
emergency contacts;
people identifiable in challenge submissions; and
people mentioned in incident reports or complaints.

18. Changes to this privacy notice

We may update this privacy notice when our services, providers or processing activities change.

The current version will be published on our website with the date of the latest update.

Where a change materially affects participants, we will provide additional notice by email, through the registration service or through an event communication channel.

19. Contact

Questions, requests or withdrawal of consent may be sent to:

Polar Bears Adventures
Email: privacy@polar-bears.no
Postal address: Øygardsbakken 9 B, 4327 Sandnes