We care about your personal data. This policy explains what we collect when you shop, play or otherwise use brightlandmaze.se and our games, why we do it, how long we keep the data and what rights you have.
1. Data controller
Brightland Maze AB (Swedish company reg. no. 559548-8189), Stockholm, Sweden, is the data controller. Send questions about how we process personal data to contact@brightlandmaze.se.
2. What we process and why
When you shop
Name, email address, phone number, delivery address or chosen service point, what you bought, amounts, payment method and the payment reference. We use the data to deliver your order, send order and shipping confirmations, handle complaints and withdrawals and to comply with the Swedish Accounting Act. Legal basis: contract and legal obligation.
When you create an Arena account
First name, email address and password (stored only as an encrypted hash), or a link to your Google account if you sign in with Google. The account holds your games, statistics, orders and – if you choose – details to make your next purchase quicker. Legal basis: contract.
When you play an online case
An email address and mobile number are verified with one-time codes when the game is started, and are used during the game to send emails and text messages and to make phone calls that are part of the story. We store the team name, the players' names or nicknames, progress, answers, clues and playing time – for the game to work, for team and account statistics, and to show finished games (team name, playing time and number of clues) on the games' news sites. Verified contact details are kept for 12 months so you can start your next game without new codes. Legal basis: contract and legitimate interest.
Gifts
If you buy a gift, we store the recipient's name, email address or phone number, your greeting and the delivery time, in order to deliver the gift. Legal basis: contract (with you) and legitimate interest (delivering the gift to the recipient).
Reviews, contact and extras
Reviews and photos you submit are stored and shown on the site once approved. Messages sent through the contact form are stored so we can reply. If you sign up as an extra, we store the details and photo in your sign-up to contact you about roles, until you ask us to remove them. Legal basis: legitimate interest and, for extras, consent.
Newsletter
If you subscribe to the newsletter, we store your email address and language. You confirm the subscription through a link in an email and can unsubscribe at any time through the link in every mailing. Legal basis: consent.
Visitor statistics and security
We count visits with our own analytics service to improve the site. Without your consent this is done without cookies, and the IP address is only used to count visits within one day and for approximate location – it is not stored. With your consent in the cookie banner, an analytics script that can link visits together is used. Forms are protected against bots with Cloudflare Turnstile, and the site's logs keep technical data such as IP addresses for a short time for security and troubleshooting. Legal basis: legitimate interest and, for script-based analytics, consent.
3. Who we share data with
We never sell personal data. We only share it when needed to provide our services:
- Payment: Kustom and PayPal handle payments. They are responsible for the data they process under their own terms and privacy policies.
- Shipping: Fraktjakt AB and DHL receive your name, contact and delivery details to ship and track the parcel.
- Text messages and calls: 46elks AB sends the games' text messages and makes the games' calls.
- Bot protection: Cloudflare (Turnstile) – may involve transfer to the USA, covered by the EU adequacy decision (EU–US Data Privacy Framework).
- Sign in with Google: only if you choose it. Google then knows that you sign in with us.
The website, email, analytics and newsletter run on servers we operate ourselves in Sweden. We may also disclose data when required by law, for example to authorities.
4. How long we keep the data
- Orders and accounting records: seven years, under the Swedish Accounting Act.
- Arena account: until you ask us to close it.
- Verified contact details for starting games: 12 months from the latest verification.
- Extra sign-ups: until you ask us to remove them.
- Newsletter: until you unsubscribe.
- Other data for as long as needed for the purpose, after which it is deleted or anonymised.
5. Your rights
You have the right to know what data we hold about you, to have errors corrected, to have data erased, to restrict processing, to object to processing based on legitimate interest and to receive data you have given us in a machine-readable format. If you have given consent, you can withdraw it at any time. Contact us at contact@brightlandmaze.se – we reply within one month. Some data may have to be kept despite a request for erasure, for example for accounting.
If you are unhappy with how we process your personal data, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or to the supervisory authority where you live.
6. Cookies and local storage
We use the cookies needed for the site to work – such as the cart, language and sign-in – and, only with your consent, cookies for statistics. They are all listed on the cookies page, where you can also change your choice. Your browser also remembers if you have closed the news panel on the site, so it is not shown again.
7. Security
Traffic to the site is encrypted, passwords and one-time codes are stored only as encrypted hashes, and access to the data is limited to staff who need it for their work.
8. Changes
We update this policy when we change how we process personal data. The date at the top shows when it was last changed.